DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71313: CVE-2026-71313: Local Directory Traversal in rclone via Unsafe Encoding Configurations

#security #cve #cybersecurity

CVE-2026-71313: Local Directory Traversal in rclone via Unsafe Encoding Configurations

Vulnerability ID: CVE-2026-71313
CVSS Score: 6.9
Published: 2026-08-05

A local encoding path traversal vulnerability exists in rclone versions from v1.51.0 up to v1.75.0. When non-default local encoding parameters (such as Slash, None, or Raw) are specified, rclone's standard decoder maps safely encoded fullwidth dot-dot characters back into native directory traversal components. Since the local backend historically lacked a post-resolution path containment check, these relative segments resolved outside the designated synchronization root, allowing arbitrary file creation and modification on the host system.

TL;DR

In rclone versions v1.51.0 to v1.74.x, configured local target encodings that omit dot-protection allow malicious remote filenames to escape the designated sync root and manipulate arbitrary host files.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.9 (Medium)
  • Exploit Status: PoC-level
  • CISA KEV Status: No

Affected Systems

  • rclone command-line utility (v1.51.0 through v1.74.x)
  • rclone: >= 1.51.0, < 1.75.0 (Fixed in: v1.75.0)

Code Analysis

Commit: 6a69713

local: fix path traversal with non-default encoding configurations

Mitigation Strategies

  • Upgrade rclone to v1.75.0 or later to enable native lexical containment checks.
  • Do not configure the local backend with custom local encoding options (such as Slash, None, or Raw) that remove standard Dot safety checks.
  • Restrict host execution context using containerization, SELinux, or AppArmor to prevent system-wide impacts from potential directory traversals.

Remediation Steps:

  1. Scan execution systems to identify installed rclone versions between v1.51.0 and v1.74.x.
  2. Apply the patch by updating to v1.75.0 or later using official vendor sources.
  3. Audit automated configurations or scripts for occurrences of '--local-encoding Slash', '--local-encoding None', or '--local-encoding Raw' parameters.

References

Read the full report for CVE-2026-71313 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)