CVE-2026-71309

Received Received - Intake

Path Traversal in Rclone Serve Restic

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71309

EUVD

EUVD-2026-53613

Affected Vendors & Products

Vendor	Product	Version / Range
rclone	rclone	From 1.40.0 (inc) to 1.75.0 (exc)
rclone	rclone	1.75.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

rclone versions 1.40.0 to 1.75.0 have a flaw in the restic server mode where URL paths starting with ../ are not properly blocked. This allows attackers with access to the REST endpoint to read, create, overwrite, or delete files outside the intended directory by exploiting path traversal.

Detection Guidance

Check if your rclone version is between 1.40.0 and 1.75.0 by running 'rclone version'. If so, the vulnerability may be present. Inspect network traffic for REST endpoint access attempts, particularly with paths starting with ../.

Impact Analysis

If you run rclone serve restic with a vulnerable version, an attacker could access sensitive files outside the configured directory, modify or delete important data, or plant malicious files. This requires the attacker to have network access to the REST endpoint.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using vulnerable versions may face compliance violations, data breaches, and potential fines.

Mitigation Strategies

Upgrade rclone to version 1.75.0 or later immediately. Disable or restrict access to the REST endpoint if not needed. Review backend configurations to ensure proper path restrictions are in place.

Hi! I’m here to help you understand CVE-2026-71309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70