CVE-2026-71312

Received Received - Intake

PowerShell Command Injection in Rclone SFTP Backend

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71312

EUVD

EUVD-2026-53619

Affected Vendors & Products

Vendor	Product	Version / Range
-rclone	rclone	to 1.75.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

rclone before v1.75.0 has a flaw in its SFTP backend where it improperly escapes filenames when passing them to PowerShell for hash commands. Attackers can exploit this by using filenames containing special single-quote characters (U+2018, U+2019, U+201A, U+201B) to break out of the intended path and inject malicious PowerShell code. This code executes with the permissions of the victim's SSH account when server-side hashing is enabled.

Detection Guidance

Detecting this vulnerability requires checking the version of rclone installed on your system. Run 'rclone version' to see the current version. If the version is below 1.75.0, the system is vulnerable.

Impact Analysis

If you use rclone with SFTP and server-side hashing, an attacker who can control filenames on the remote server could execute arbitrary commands on your system with your user privileges. This could lead to data theft, system compromise, or further network access depending on your environment.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality requirements in GDPR and HIPAA. Organizations using rclone in regulated environments may face compliance violations if attackers exploit this to access or exfiltrate sensitive data.

Mitigation Strategies

Upgrade rclone to version 1.75.0 or later immediately. This can be done by downloading the latest version from the official rclone website or using your package manager to update the software.

Hi! I’m here to help you understand CVE-2026-71312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70