Rclone · weakness class
File and Path Handling
14 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.
- rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
- rclone: Incomplete path validation allows backend root escape in serve restic
- rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
- Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
- rclone serve s3 Path Traversal via dot-dot object keys
- rclone: Local Encoding Path Traversal
- rclone: source object names can escape the configured root on upload
- rclone before 1.75.1 Path Traversal via Directory Listing Names
- rclone archive extract allows S3 destination prefix escape via crafted archive paths
- Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata
- Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
- rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
- rclone serve docker Path Traversal via Volume Name
- rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.