Vulnerability Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.
Related Weaknesses (CWE)
References
- https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264
- https://github.com/rclone/rclone/releases/tag/v1.75.0
- https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh
- https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh
FAQ
What is CVE-2026-71309?
CVE-2026-71309 is a documented vulnerability. rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginnin...
How severe is CVE-2026-71309?
CVSS scoring is not yet available for CVE-2026-71309. Check NVD for updates.
Is there a patch for CVE-2026-71309?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.