Security
فارسی
All products

github.com/rclone/rclone

Go · Package
29 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirectCVE-2026-79782 · GHSA-GX4C-2HQX-CW2RVersion ranges need review. github.com/rclone/rclone Go Low Fix reported
rclone: source object names can escape the configured root on uploadCVE-2026-88046 · GHSA-38XV-HF3P-H7MQVersion ranges need review. github.com/rclone/rcloneCryostat 4/cryostat/cryostat-storage-rhel9 GoRed Hat Medium Fix reported
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespaceCVE-2026-88014 · GHSA-66HP-WGXQ-6F5QVersion ranges need review. github.com/rclone/rcloneCryostat 4/cryostat/cryostat-storage-rhel9 GoRed Hat Medium Fix reported
rclone: http backend forwards custom/auth headers to a different host on redirectCVE-2026-88013 · GHSA-486V-Q2WF-FP2RVersion ranges need review. github.com/rclone/rcloneCryostat 4/cryostat/cryostat-storage-rhel9 GoRed Hat Low Fix reported
rclone: RC per-server auth-proxy bypassCVE-2026-88044 · GHSA-P569-5GJG-9CMJVersion ranges need review. github.com/rclone/rclone Go Critical Fix reported
rclone local: crafted Range request against a translated symlink panics (DoS)CVE-2026-88015 · GHSA-P6M2-R3W9-MPXWVersion ranges need review. github.com/rclone/rcloneCryostat 4/cryostat/cryostat-storage-rhel9 GoRed Hat Medium Fix reported
rclone: S3 multipart declared-length memory exhaustionCVE-2026-88045 · GHSA-2P48-J3QC-RX9FVersion ranges need review. github.com/rclone/rclone Go High Fix reported
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassCVE-2026-88018 · GHSA-XWWR-4H3P-R22CVersion ranges need review. github.com/rclone/rclone Go Critical Fix reported
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationCVE-2026-88016 · GHSA-F8G7-2XJC-7MFHVersion ranges need review. github.com/rclone/rclone Go Medium Fix reported
rclone: FTP cross-session auth-proxy backend confusionCVE-2026-88017 · GHSA-C476-6W5Q-JW77Version ranges need review. github.com/rclone/rclone Go High Fix reported
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone MemoryCVE-2026-71310 · GHSA-XHF4-832V-7XCRVersion ranges need review. github.com/rclone/rcloneRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-rhel9 GoRed Hat Medium Fix reported
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remoteCVE-2026-54572 · GHSA-CF44-9PGV-M4XCVersion ranges need review. github.com/rclone/rclone Go High Fix reported
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command ExecutionCVE-2026-71312 · GHSA-2M8M-JHRM-W6J2Version ranges need review. github.com/rclone/rclone Go High Fix reported
rclone: Incomplete path validation allows backend root escape in serve resticCVE-2026-71309 · GHSA-45PQ-889G-FCGHVersion ranges need review. github.com/rclone/rclone Go High Fix reported
rclone: Local Encoding Path TraversalCVE-2026-71313 · GHSA-7P4M-QXVV-G567Version ranges need review. github.com/rclone/rcloneRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-rhel9 GoRed Hat Medium Fix reported
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesCVE-2026-59733 · GHSA-FQJ9-69PF-6PJGVersion ranges need review. github.com/rclone/rclone Go High Fix reported
rclone archive extract allows S3 destination prefix escape via crafted archive pathsCVE-2026-59732 · GHSA-4VR5-P2GC-H23PVersion ranges need review. github.com/rclone/rclone Go Medium Fix reported
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves NewlinesCVE-2026-71311 · GHSA-8C48-Q9WJ-3W37Version ranges need review. github.com/rclone/rclone Go Medium Fix reported
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixCVE-2026-49980 · GHSA-QW24-GH76-8RVVVersion ranges need review. github.com/ncw/rclonegithub.com/rclone/rclone Go Critical Fix reported
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionCVE-2026-41179 · GHSA-JFWF-28XR-XW6QVersion ranges need review. github.com/ncw/rclonegithub.com/rclone/rclone Go Critical Fix reported