CVE-2026-71311

Received Received - Intake

FTP Command Injection in rclone

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71311

EUVD

EUVD-2026-53618

Affected Vendors & Products

Vendor	Product	Version / Range
-rclone	rclone	to 1.75.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

This vulnerability in rclone before 1.75.0 allows an attacker to inject FTP commands via crafted filenames containing CR/LF characters. When a victim syncs files to a privileged FTP server, the attacker-controlled path can manipulate the FTP control channel to execute unauthorized commands like DELE or NOOP.

Detection Guidance

Detecting this vulnerability requires checking the version of rclone installed on your system. Run 'rclone version' to see the current version. If it is below 1.75.0, the system is vulnerable. Additionally, monitor FTP traffic for unusual commands or sequences involving CR/LF characters in filenames.

Impact Analysis

If exploited, this flaw could allow an attacker to delete files or perform other unauthorized actions on your FTP server. It requires the victim to sync files to a malicious or compromised FTP destination, but could lead to data loss or unauthorized access.

Mitigation Strategies

Upgrade rclone to version 1.75.0 or later immediately. Avoid using FTP for sensitive operations until the upgrade is complete. Review and restrict FTP access permissions to minimize potential impact.

Hi! I’m here to help you understand CVE-2026-71311. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70