Path Traversal Issue in Rclone by Rclone Developers

CVE-2026-116191

What is CVE-2026-116191?

Rclone versions prior to 1.75.2 are susceptible to a path traversal vulnerability in the serve webdav feature. This flaw could allow attackers without authentication to manipulate file paths above the intended directory. By sending specially crafted requests with unvalidated '..' path components, an attacker can create or modify files, leading to potential data breaches. Specifically, the MKCOL command can be exploited to establish a VFS node, followed by essential commands like PUT, MOVE, COPY, or MKCOL to alter files associated with other tenants.

References