CVE-2026-59733: Rclone Path Traversal Vulnerability

CVE-2026-59733 Overview

CVE-2026-59733 is a path traversal vulnerability [CWE-22] in Rclone, a command-line utility for syncing files across cloud storage providers. The flaw affects rclone serve restic --private-repos in versions prior to 1.74.4. Authorization is enforced using the routed user path segment, while the backend object key is built from the raw uncleaned URL path. An authenticated user can include .. sequences in requests such as //..//config to read, overwrite, or delete another user's private repository on backends that clean path components. The issue is fixed in version 1.74.4.

Critical Impact
Authenticated users can bypass private-repository isolation to access, modify, or destroy other users' restic backups stored through rclone serve restic.

Affected Products

Rclone versions prior to 1.74.4
Deployments running rclone serve restic with --private-repos enabled
Backends that normalize or clean path components when handling object keys

Discovery Timeline

2026-07-14 - CVE-2026-59733 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-59733

Vulnerability Analysis

The rclone serve restic command exposes a restic-compatible REST API backed by any rclone-supported storage provider. When invoked with --private-repos, the server is designed to isolate each authenticated user to a repository namespace derived from their username. The vulnerability arises because two different representations of the request path are used for two different security-relevant decisions.

Authorization checks operate on the routed user path segment, which correctly identifies the authenticated user's repository prefix. However, the backend object key used to actually read or write data on the storage provider is constructed from the raw, uncleaned URL path. This inconsistency allows a request path containing .. segments to pass the authorization check while resolving to a location outside the caller's namespace once the backend normalizes the path.

Root Cause

The root cause is inconsistent path canonicalization between the authorization layer and the storage backend layer. The server accepts URL paths containing .. and consecutive slashes without normalization before constructing the backend key. Storage backends that clean path components then collapse sequences such as //..//config into a sibling path, granting the request access to another user's repository objects.

Attack Vector

An attacker requires valid credentials for the rclone restic server. The attacker crafts an HTTP request whose path begins with their authorized user segment but embeds .. traversal tokens, for example /user_a/..//user_b/config. The routing layer treats the request as belonging to user_a and permits it, while the backend resolves the final key to user_b/config. This enables reading credentials and repository metadata, overwriting objects to corrupt backups, or deleting another tenant's data. No user interaction is required and the attack is fully network-based.

See the GitHub Security Advisory GHSA-fqj9-69pf-6pjg for additional technical details.

Detection Methods for CVE-2026-59733

Indicators of Compromise

HTTP requests to rclone serve restic endpoints containing .. segments, consecutive slashes (//), or URL-encoded traversal sequences such as %2e%2e and %2f%2f.
Access log entries where the initial path segment does not match the repository actually modified on the storage backend.
Unexpected writes, overwrites, or deletions of config, keys/, data/, index/, or snapshots/ objects across tenant repositories.

Detection Strategies

Inspect rclone HTTP access logs for request paths containing .., //, or mixed-case encoded traversal tokens targeting /config, /keys/, or /data/.
Correlate authenticated username with the storage-side object key touched by each request and alert when they diverge.
Compare backend object mutation events with the routed user segment recorded upstream to identify authorization-versus-resolution mismatches.

Monitoring Recommendations

Enable verbose request logging on rclone serve restic and forward logs to a central analytics platform for path-pattern analysis.
Monitor storage backend audit logs (S3, Azure Blob, GCS) for cross-prefix access patterns originating from the rclone service account.
Alert on any restic config object read or overwrite outside a user's expected repository prefix.

How to Mitigate CVE-2026-59733

Immediate Actions Required

Upgrade rclone to version 1.74.4 or later on all hosts running rclone serve restic --private-repos.
Rotate any restic repository credentials that may have been exposed to other authenticated users of the same server.
Audit backend storage for unauthorized modifications to config, keys/, and snapshot objects across tenant namespaces.

Patch Information

The fix is included in rclone v1.74.4. The remediation is delivered in commits 015fd0eba1cb138eef081517795fed47a2873f2d and dade21c1616035b044df0eef7ee6a85aeb06a139, which align path handling between the authorization check and backend key construction so that traversal sequences cannot cross repository boundaries.

Workarounds

If patching is not immediately feasible, disable --private-repos and run separate rclone processes per user with independent credentials and storage prefixes.
Place a reverse proxy in front of rclone serve restic that rejects any request path containing .., //, or encoded traversal sequences before it reaches the rclone process.
Restrict network access to the restic server to trusted clients only until the upgrade is complete.

bash

# Verify the installed rclone version is patched
rclone version

# Upgrade rclone (example for Linux)
curl https://rclone.org/install.sh | sudo bash

# Example reverse-proxy rule (nginx) to block traversal payloads
# location / {
#     if ($request_uri ~* "(\.\.|//)") { return 400; }
#     proxy_pass http://127.0.0.1:8080;
# }