CVE-2026-71311: CVE-2026-71311: FTP Command Injection via Path CRLF Injection in rclone FTP Backend

#security #cve #cybersecurity

CVE-2026-71311: FTP Command Injection via Path CRLF Injection in rclone FTP Backend

Vulnerability ID: CVE-2026-71311
CVSS Score: 6.4
Published: 2026-08-05

A protocol-level CRLF injection vulnerability exists in rclone's FTP backend before version 1.75.0. When configured with a non-default filename encoding, rclone allows carriage return and line feed characters to pass directly into the underlying FTP client library. Because the library constructs line-oriented control commands without input validation, an attacker-controlled filename can inject arbitrary FTP commands into the session, allowing unauthorized file deletion and modification on the target server.

TL;DR

Insecure filename encoding in rclone's FTP backend combined with lack of validation in the underlying FTP library allows attackers to inject arbitrary FTP commands via crafted filenames.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Attack Vector: Network (AV:N)
Attack Complexity: High (AC:H)
Privileges Required: Low (PR:L)
User Interaction: Required (UI:R)
CVSS v3.1 Score: 6.4 (Medium)
Exploit Status: Proof of Concept / Conceptual
CISA KEV Status: Not Listed

Affected Systems

rclone versions prior to 1.75.0 utilizing the FTP backend with non-default filename encodings
rclone: < 1.75.0 (Fixed in: 1.75.0)

Code Analysis

Commit: 1df2b70

ftp: force raw CR/LF to be encoded in command arguments

@@ -637,6 +637,18 @@ func (f *Fs) drainPool(ctx context.Context) (err error) {
    return err
 }

+func commandEncoding(enc encoder.MultiEncoder) encoder.MultiEncoder {
+   return enc | encoder.EncodeCrLf
+}
+
 func NewFs(ctx context.Context, name, root string, m configmap.Mapper) (ff fs.Fs, err error) {
@@ -646,6 +658,7 @@ func NewFs(ctx context.Context, name, root string, m configmap.Mapper) (ff fs.Fs
    if err != nil {
        return nil, err
    }
+   opt.Enc = commandEncoding(opt.Enc)

Mitigation Strategies

Upgrade rclone installations to version 1.75.0 or later.
Remove non-default custom encoding options (such as 'None' or 'Slash') from rclone FTP backend configurations to restore default safety filters.
Restrict directory write privileges on the synchronization source to prevent untrusted users from introducing files with custom control characters.

Remediation Steps:

Identify all production nodes running rclone instances.
Verify configuration files (typically located at ~/.config/rclone/rclone.conf) for custom 'encoding' parameters in FTP server definitions.
Apply the v1.75.0 update across all systems.
Verify compliance by attempting to sync a test file containing safe encoded representations of carriage returns.

References

Read the full report for CVE-2026-71311 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community