CVE-2026-71309: rclone Path Traversal Vulnerability

CVE-2026-71309 Overview

CVE-2026-71309 is a path traversal vulnerability [CWE-22] in rclone, a command-line program for syncing files between cloud storage providers. The flaw exists in rclone serve restic from version 1.40.0 through 1.74.x. The WithRemote function in cmd/serve/restic/restic.go fails to reject URL paths beginning with ../, allowing attackers to escape the operator-configured directory. Affected backends include WebDAV, FTP, HTTP, Memory, and SFTP. The issue is fixed in rclone 1.75.0.

Critical Impact
Authenticated attackers with REST endpoint access can read, create, overwrite, or delete objects outside the configured backend subdirectory when the backend credential has broader access.

Affected Products

rclone versions 1.40.0 through 1.74.x
rclone serve restic command with WebDAV, FTP, HTTP, Memory, or SFTP backends
Deployments publishing a backend subdirectory where credentials access parent or sibling objects

Discovery Timeline

2026-08-05 - CVE-2026-71309 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71309

Vulnerability Analysis

The vulnerability resides in the WithRemote function within cmd/serve/restic/restic.go. This function processes remote paths from incoming HTTP requests to the restic REST server. It fails to validate or sanitize path components containing ../ sequences before passing them to backend handlers.

The accepted parent path traversal reaches GET, HEAD, POST, and DELETE handlers. These handlers execute file operations against the configured storage backend using the attacker-controlled path. When an operator publishes only a subdirectory but the underlying backend credential holds broader permissions, attackers pivot outside the intended boundary.

Affected backends include WebDAV, FTP, HTTP, Memory, and SFTP. Impact includes unauthorized read of sibling objects, overwrite of parent-directory files, arbitrary object creation, and deletion of data outside the served scope.

Root Cause

The root cause is missing input validation on URL path components in the REST server routing logic. The WithRemote helper concatenated user-supplied path segments with the configured remote without rejecting leading ../ sequences or canonicalizing the resulting path.

Attack Vector

An authenticated attacker sends HTTP requests with crafted paths containing ../ sequences to the rclone serve restic endpoint. Because path handling occurs before backend dispatch, the traversal propagates to every supported backend operation. The attacker needs network access to the REST endpoint and valid credentials if authentication is enabled.

// Patch imports added in cmd/serve/restic/restic.go
	"encoding/json"
	"errors"
	"fmt"
	iofs "io/fs"
	"net"
	"net/http"
	"os"

Source: rclone commit cc5a189. The patch introduces io/fs for standardized path validation and rejects traversal sequences before they reach backend handlers.

Detection Methods for CVE-2026-71309

Indicators of Compromise

HTTP request logs to rclone serve restic endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the path
Backend audit logs showing object access or deletion outside the operator-published subdirectory
Unexpected POST or DELETE operations against parent or sibling paths in WebDAV, FTP, SFTP, or HTTP backends

Detection Strategies

Inspect reverse-proxy or load-balancer logs fronting rclone for path segments containing .. before forwarding to the restic REST server
Correlate rclone process command-line arguments with backend credential scope to identify overprivileged deployments
Monitor for anomalous file access patterns in backend storage that fall outside expected restic repository structure

Monitoring Recommendations

Enable verbose logging on rclone with --log-level DEBUG and forward logs to a centralized SIEM for retrospective analysis
Alert on any 200-series responses to requests whose decoded URL path resolves outside the configured --serve-restic root
Track version strings of running rclone binaries across the fleet to identify hosts below 1.75.0

How to Mitigate CVE-2026-71309

Immediate Actions Required

Upgrade rclone to version 1.75.0 or later on all systems running rclone serve restic
Restrict the backend credential used by rclone to the minimum scope required, ideally the exact published subdirectory
Place the restic REST endpoint behind an authenticated reverse proxy that normalizes and rejects ../ in URL paths
Audit backend storage for unauthorized creation, modification, or deletion of objects outside the served path

Patch Information

The fix is available in rclone release v1.75.0. Details are documented in the GitHub Security Advisory GHSA-45pq-889g-fcgh. The corrective commit is cc5a189, which adds path validation using the io/fs package in cmd/serve/restic/restic.go.

Workarounds

Terminate rclone serve restic instances until upgrade to 1.75.0 is complete
Configure backend credentials that cannot access any object outside the intended published subdirectory
Deploy a WAF or reverse proxy rule that rejects requests containing .. path segments before they reach rclone

bash

# Verify installed rclone version and upgrade
rclone version
# Upgrade to fixed release
curl https://rclone.org/install.sh | sudo bash
# Confirm patched version
rclone version | grep -E 'v1\.(7[5-9]|[89][0-9])'