---
id: CVE-2026-88046
title: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers
summary: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers. Prior to 1.75.1, rclone core does not
  reject parent-directory segments in source Object.Remote() values before
  fs/list, fs/walk…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
vendor: rclone
product: rclone
affected:
  - rclone < 1.75.1
published: '2026-09-10'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T15:17:24.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88046'
references:
  - url: >-
      https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.75.1'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88046'
  - url: 'https://github.com/rclone/rclone'
tags:
  - nvd
  - cve.org
  - osv
  - go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T14:47:22.197480Z'
epss: 0.00294
epssPercentile: 0.22288
ingestedAt: '2026-09-14T15:21:27.316Z'
aliases:
  - GHSA-38xv-hf3p-h7mq
  - GO-2026-6457
  - BIT-rclone-2026-88046
ecosystem: go
patched:
  - github.com/rclone/rclone 1.75.1
---

## Overview

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination backends. A flat-keyspace source object store populated with native non-rclone tooling can contain a raw .. key segment, and affected b2, swift, qingstor, oracleobjectstorage, internetarchive, smb, storj, sftp, webdav, ftp, filelu, shade, and sia destinations use path.Join(root, remote) before EncodeDot can neutralize the segment. A copy or upload can therefore escape the configured root into another bucket, share, or path reachable by the victim credential, with sftp and smb potentially reaching other filesystem or share locations under the same login authority. This issue is fixed in version 1.75.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-88046)

Affected packages:

- `github.com/rclone/rclone < 1.75.1`

Patched in:

- `github.com/rclone/rclone 1.75.1`

Source: https://osv.dev/vulnerability/GHSA-38xv-hf3p-h7mq