CVE-2026-93986

Received Received - Intake

rclone Path Traversal Vulnerability Before 1.75.1

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93986

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

rclone before version 1.75.1 does not properly restrict file paths received from servers or third-party listings. This allows attackers to include path traversal sequences like forward slashes or parent directory references in file names. While local backend protections currently prevent actual file escapes, the vulnerability could potentially allow writing outside the intended destination directory.

Impact Analysis

An attacker could trick you into downloading files to unintended locations on your system by crafting malicious file names. This might lead to overwriting important files, storing malicious content in sensitive directories, or disrupting normal operations. However, current protections in the local backend limit the actual impact.

Compliance Impact

This vulnerability could potentially violate compliance requirements by allowing unauthorized file writes outside designated directories, which may compromise data integrity or confidentiality. Organizations handling sensitive data under GDPR or HIPAA might face increased risk if attackers exploit this to access or modify protected files.

Mitigation Strategies

Upgrade rclone to version 1.75.1 or later to address the path traversal issue in server and third-party listing responses.

Hi! I’m here to help you understand CVE-2026-93986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70