CVE-2026-116191High· 7.5▾ TwilightRclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
rclone < 1.75.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116195Medium· 6.1Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
CVE-2026-93986Low· 3.1rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names
CVE-2026-88046Medium· 5.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88014Medium· 6.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-116193Medium· 5.3Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
CVE-2026-116187Medium· 5.0Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads