CVE-2026-88046: CVE-2026-88046: Directory Traversal and Root Confinement Escape in rclone Core Engine

#security #cve #cybersecurity

CVE-2026-88046: Directory Traversal and Root Confinement Escape in rclone Core Engine

Vulnerability ID: CVE-2026-88046
CVSS Score: 5.3
Published: 2026-09-10

CVE-2026-88046 (also tracked via GHSA-38xv-hf3p-h7mq) is a directory traversal and root confinement escape vulnerability residing in the core listing and transfer logic of rclone. Prior to version 1.75.1, raw relative parent-directory sequences returned by flat-keyspace source backends are trusted and processed without proper sanitization, enabling writes outside the designated target root or bucket.

TL;DR

A path traversal vulnerability in rclone versions prior to 1.75.1 allows attackers with control over a source flat-keyspace storage provider to write arbitrary files to unauthorized directories on target backends.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network / User Interaction Required
CVSS v3.1: 5.3 (Medium)
Exploit Status: PoC Available
KEV Status: Not Listed

Affected Systems

rclone
rclone: < 1.75.1 (Fixed in: 1.75.1)

Code Analysis

Commit: 57842c5

Fix directory traversal vulnerability by introducing RemoteEscapesRoot validation

Mitigation Strategies

Upgrade rclone client binaries to version 1.75.1 or newer.
Audit existing cloud storage namespaces for relative parent-directory sequences (..).
Apply principle of least privilege to service accounts used during rclone executions.

Remediation Steps:

Identify all production environments using rclone via 'rclone version'.
Deploy rclone 1.75.1 or higher to all running container environments, cron servers, and user workstations.
Audit automated workflows targeting external/untrusted data sources and establish strict validation boundaries.

References

Read the full report for CVE-2026-88046 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community