RC
Product
rclone
44
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 5High 11Medium 22Low 6
Watch
Add rclone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-71313 | 6.9 | Aug 5 | rclone: Local Encoding Path Traversal Affected: >= 1.51.0, < 1.75.0 |
| CVE-2026-116194 New | 6.8 | Oct 25 | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback Affected: 1.52.0 before 1.75.2 |
| CVE-2026-79781 | 6.5 | Aug 25 | rclone serve s3 Path Traversal via dot-dot object keys Affected: before 1.74.4 |
| CVE-2026-79775 | 6.5 | Aug 25 | rclone Archive Backend SquashFS Parser Denial of Service Affected: 1.72.0 through 1.74.4 |
| CVE-2026-71311 | 6.4 | Aug 5 | rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines Affected: < 1.75.0 |
| CVE-2026-88014 | 6.3 | Sep 10 | rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace Affected: >= 1.72.0, < 1.75.1 |
| CVE-2026-116195 New | 6.1 | Oct 25 | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim Affected: before 1.75.2 |
| CVE-2026-116192 New | 5.9 | Oct 25 | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots Affected: 1.37 before 1.74.2 |
| CVE-2026-71310 | 5.9 | Aug 5 | rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory Affected: < 1.75.0 |
| CVE-2024-52522 | 5.4 | Nov 15 | Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata Affected: >= 1.59.0, < 1.68.2 |
| CVE-2026-116196 New | 5.3 | Oct 25 | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url Affected: before 1.75.2 |
| CVE-2026-116193 New | 5.3 | Oct 25 | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests Affected: 1.64.0 before 1.75.2 |
| CVE-2026-116188 New | 5.3 | Oct 25 | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow Affected: 1.75.0 before 1.75.2 |
| CVE-2026-88046 | 5.3 | Sep 10 | rclone: source object names can escape the configured root on upload Affected: < 1.75.1 |
| CVE-2026-88015 | 5.3 | Sep 10 | rclone local: crafted Range request against a translated symlink panics (DoS) Affected: < 1.75.1 |
| CVE-2026-88013 | 5.3 | Sep 10 | rclone: http backend forwards custom/auth headers to a different host on redirect Affected: >= 1.49.0, < 1.75.1 |
| CVE-2026-79780 | 5.3 | Aug 25 | rclone before v1.75.0 Credential Exposure via S3 Redirect Affected: before 1.75.0 |
| CVE-2026-79779 | 5.3 | Aug 25 | rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect Affected: before 1.75.0 |
| CVE-2026-79778 | 5.3 | Aug 25 | rclone before v1.75.0 Denial of Service via TUS nil-response panic Affected: before 1.75.0 |
| CVE-2026-79776 | 5.3 | Aug 25 | rclone before 1.75.0 Authentication Bypass via pprof Affected: before 1.75.0 |
| CVE-2026-116187 New | 5.0 | Oct 25 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads Affected: 1.68.0 before 1.75.2 |
| CVE-2026-59732 | 5.0 | Jul 14 | rclone archive extract allows S3 destination prefix escape via crafted archive paths Affected: < 1.74.4 |
Showing 22