DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71312: CVE-2026-71312: OS Command Injection via Unicode Smart Quote Shell Bypass in rclone SFTP Backend

#security #cve #cybersecurity

CVE-2026-71312: OS Command Injection via Unicode Smart Quote Shell Bypass in rclone SFTP Backend

Vulnerability ID: CVE-2026-71312
CVSS Score: 8.0
Published: 2026-08-05

An incomplete sanitization vulnerability exists in rclone's SFTP backend before version 1.75.0 when performing server-side hashing operations on Windows hosts. Due to PowerShell treating Unicode smart quotes as equivalent to ASCII single quotes, malicious file paths can escape command string delimiters and execute arbitrary commands on the remote system.

TL;DR

rclone versions prior to 1.75.0 are vulnerable to remote OS command injection when executing server-side hashing on Windows SFTP targets. Attackers can leverage Unicode smart quotes in file paths to bypass single-quote sanitization and execute arbitrary PowerShell commands.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-78
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.0
  • Exploit Status: PoC / Theoretical
  • CISA KEV Status: Not Listed
  • Impact: Remote Command Execution (RCE)
  • Remediation: Upgrade to v1.75.0 or higher

Affected Systems

  • rclone installations prior to version 1.75.0 interacting with Windows-based SFTP servers using PowerShell
  • rclone: < 1.75.0 (Fixed in: 1.75.0)

Code Analysis

Commit: e122fba

backend/sftp: fix escaping for PowerShell single-quote delimiters

Exploit Details

Mitigation Strategies

  • Upgrade rclone to version 1.75.0 or later
  • Reconfigure Windows SSH server to use cmd.exe instead of PowerShell as the default shell
  • Implement filename sanitization rules on the SFTP server to block Unicode smart quotes (U+2018 through U+201B)

Remediation Steps:

  1. Identify all systems executing rclone commands against Windows SFTP servers.
  2. Update rclone installations to version 1.75.0 or higher.
  3. For systems that cannot be patched immediately, apply server-side mitigations by changing the default SSH shell to cmd.exe.

References

Read the full report for CVE-2026-71312 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)