Vulnerabilidades do Rclone Rclone

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Rclone Rclone: 6 registro(s), com versões afetadas e correções.
cpe:2.3:a:rclone:rclone

CVE-2026-59733 Alta · 8.8 CWE-22 14/07/2026

Path Traversal em Rclone

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.

CVE-2026-59732 Média · 5.0 CWE-22 14/07/2026

Path Traversal em Rclone

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

CVE-2026-54572 Alta · 8.8 CWE-59 14/07/2026

Link Following em Rclone

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

CVE-2026-49980 Crítica · 9.8 CWE-306 24/06/2026

Rclone rcd --rc-serve: ausência de autenticação permite execução de comandos (CVE-2026-49980)

Rclone é um programa de linha de comando para sincronizar arquivos e diretórios com diferentes provedores de armazenamento em nuvem. Da versão 1.46.0 até a versão 1.74.3, o rclone rcd --rc-serve aceita requisições GET e HEAD sem autenticação para caminhos na forma: /[remote:path]/object. O valor de remote é extraído da URL e passado para a inicialização normal do backend. A configuração inline de remote pode definir opções de backend que executam comandos locais durante a inicialização. Como resultado, uma única requisição GET ou HEAD sem autenticação pode executar um comando como usuário do processo rclone. Esta vulnerabilidade está corrigida na versão 1.74.3.

CVE-2026-41179 Crítica · 9.8 Exploit público CWE-78 22/04/2026

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

CVE-2026-41176 Crítica · 9.8 Exploit público CWE-306 22/04/2026

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.