{"id":"CVE-2026-71313","title":"rclone is a command-line program to sync files and directories to and from different cloud storage providers","summary":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent …","severity":"medium","cvss":6.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L","cwe":["CWE-22"],"vendor":"rclone","product":"github.com/rclone/rclone","affected":["github.com/rclone/rclone >= 1.51.0, <= 1.74.4"],"patched":["github.com/rclone/rclone 1.75.0"],"published":"2026-08-05","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:50:00.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71313","references":[{"url":"https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/releases/tag/v1.75.0","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-7p4m-qxvv-g567"},{"url":"https://github.com/rclone/rclone"}],"tags":["nvd","ghsa","go","osv"],"epss":0.00298,"epssPercentile":0.2262,"aliases":["GHSA-7p4m-qxvv-g567","BIT-rclone-2026-71313","GO-2026-6186"],"ecosystem":"go","ingestedAt":"2026-08-05T20:51:27.741Z","slug":"CVE-2026-71313","body":"## Overview\n\nrclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path syntax, so a local destination using Slash, None, Raw, or on Windows an encoding that preserves backslash can decode a standard-encoded fullwidth dot-dot component or native backslash form into an actual parent-directory component before filepath.Join resolves it outside the configured local root, allowing an attacker-controlled source object to create or overwrite files outside the selected destination directory as the rclone process. This issue is fixed in v1.75.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71313)\n\nAffected packages:\n\n- `github.com/rclone/rclone >= 1.51.0, <= 1.74.4`\n\nPatched in:\n\n- `github.com/rclone/rclone 1.75.0`\n\nSource: https://github.com/advisories/GHSA-7p4m-qxvv-g567","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}