Authorization Bypass in Rclone Command-Line Tool

CVE-2026-59733

What is CVE-2026-59733?

Rclone, a command-line tool for syncing files across various cloud storage services, has an authorization bypass vulnerability prior to version 1.74.4. This issue arises when the tool processes requests for private repositories, allowing authenticated users to exploit uncleaned URL paths. Specifically, the vulnerability enables users to manipulate backend object keys via requests that contain path traversal sequences, such as '..'. As a consequence, users may gain unauthorized access to, modify, or delete other users' private repositories stored on backends that sanitize path components. Rclone users are urged to upgrade to version 1.74.4 or later to mitigate this risk. For further details, consult the security advisory, and stay informed about updates and patches.

References