DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59733: CVE-2026-59733: Path Traversal and Authorization Bypass in Rclone serve restic

#security #cve #cybersecurity

CVE-2026-59733: Path Traversal and Authorization Bypass in Rclone serve restic

Vulnerability ID: CVE-2026-59733
CVSS Score: 8.8
Published: 2026-08-05

A critical path traversal and authorization bypass vulnerability exists in the rclone serve restic command when multi-user isolation is enabled using the --private-repos flag. Due to a middleware desynchronization flaw, authenticated users can access, modify, or delete backup repositories belonging to other tenants.

TL;DR

A middleware path-desynchronization defect in rclone serve restic allows authenticated users to bypass repository isolation and access other tenants' backups using path traversal sequences.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22, CWE-639
  • Attack Vector: Network (Remote)
  • CVSS v3.1: 8.8 (High)
  • EPSS Score: 0.00422
  • Impact: Complete compromise of repository confidentiality, integrity, and availability
  • Exploit Status: Proof-of-Concept (PoC) available
  • CISA KEV Status: Not listed

Affected Systems

  • Rclone (serve restic subcommand)
  • rclone: < 1.74.4 (Fixed in: 1.74.4)

Code Analysis

Commit: 015fd0e

serve restic: prevent path traversal via non-canonical paths

Commit: dade21c

serve restic: prevent path traversal via non-canonical paths (cherry-pick)

Exploit Details

Mitigation Strategies

  • Upgrade rclone to version 1.74.4 or higher
  • Run separate single-tenant daemons instead of using --private-repos flag
  • Deploy an upstream WAF or reverse proxy to block path traversal sequences

Remediation Steps:

  1. Identify all active rclone instances executing 'serve restic' with the '--private-repos' argument
  2. Download the latest stable release (v1.74.4 or later) from official sources
  3. Replace the existing rclone binary with the updated version
  4. Restart the service and monitor access logs for HTTP 400 responses to verify block mechanisms

References

Read the full report for CVE-2026-59733 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)