RC
Product
rclone
43
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 5High 11Medium 21Low 6
Watch
Add rclone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59733 | 8.8 | Jul 14 | rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories Affected: < 1.74.4 |
| CVE-2026-54572 | 8.8 | Jul 14 | rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote Affected: < 1.74.4 |
| CVE-2026-71309 | 8.6 | Aug 5 | rclone: Incomplete path validation allows backend root escape in serve restic Affected: >= 1.40.0, < 1.75.0 |
| CVE-2026-71312 | 8.0 | Aug 5 | rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution Affected: < 1.75.0 |
| CVE-2026-116191 New | 7.5 | Oct 25 | Rclone before 1.75.2 Path Traversal via serve webdav MKCOL Affected: before 1.75.2 |
| CVE-2026-116189 New | 7.5 | Oct 25 | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS Affected: 1.55.0 before 1.75.2 |
| CVE-2026-88045 | 7.5 | Sep 10 | rclone: S3 multipart declared-length memory exhaustion Affected: >= 1.75.0, < 1.75.1 |
| CVE-2020-28924 | 7.5 | Nov 19 | An issue was discovered in Rclone before 1.53.3 Affected: before 1.53.3 |
| CVE-2018-12907 | 7.5 | Jun 27 | In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google,… Affected: 1.42 |
| CVE-2026-88017 | 7.3 | Sep 10 | rclone: FTP cross-session auth-proxy backend confusion Affected: >= 1.64.0, < 1.75.1 |
| CVE-2026-88016 | 7.1 | Sep 10 | rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination Affected: < 1.75.1 |
Showing 11