GHSA-44pm-2q5p-fm63: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

Q: Who is exposed to this issue?

Deployments running Rclone before 1.75.2 with the serve webdav functionality exposed are affected. The issue can allow one tenant to affect files belonging to other tenants outside the served root.

Q: What does an attacker need to exploit it?

An attacker can exploit the issue remotely without authentication or user interaction. They send an MKCOL request containing an unvalidated '..' path component, then use PUT, MOVE, COPY, or MKCOL operations to manipulate files.

Q: What version addresses the vulnerability?

Upgrade Rclone to version 1.75.2 or later. Versions before 1.75.2 are affected.

Published Oct 25, 2026

Updated

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

Affected Software

1 affected componentFixes available

bitnami/rclone<1.75.2

1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/rclone to a version that resolves this vulnerability.
Fixed in 1.75.2

Event History

Oct 25, 2026

CVE Published

via OSV·01:20 PM

Data Sourced

via OSV·01:20 PM

DescriptionSeverityWeakness

Oct 29, 2026

Advisory Published

via OSV·08:58 AM

Data Sourced

via OSV·08:58 AM

Affected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments running Rclone before 1.75.2 with the serve webdav functionality exposed are affected. The issue can allow one tenant to affect files belonging to other tenants outside the served root.

What does an attacker need to exploit it?

An attacker can exploit the issue remotely without authentication or user interaction. They send an MKCOL request containing an unvalidated '..' path component, then use PUT, MOVE, COPY, or MKCOL operations to manipulate files.

What version addresses the vulnerability?

Upgrade Rclone to version 1.75.2 or later. Versions before 1.75.2 are affected.

GHSA-44pm-2q5p-fm63: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What version addresses the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What version addresses the vulnerability?