CVE-2026-71311: Rclone Path Traversal Vulnerability

CVE-2026-71311 Overview

CVE-2026-71311 is a File Transfer Protocol (FTP) command injection vulnerability in rclone, a command-line program used to sync files and directories across cloud storage providers. Versions prior to 1.75.0 allow a nondefault filename encoding in backend/ftp/ftp.go to restore raw carriage return and line feed (CR/LF) bytes before an attacker-controlled path reaches the line-oriented FTP control channel. The github.com/jlaffaye/ftp library then passes the argument through textproto.Conn.Cmd without rejecting CR or LF. Attackers can craft filenames such as victim<CRLF>DELE other-secret<CRLF>NOOP to inject independent authenticated FTP commands when a victim copies or syncs to a more-privileged FTP destination. The issue is fixed in rclone 1.75.0.

Critical Impact
An attacker who controls filenames on a source can inject authenticated FTP commands against a more-privileged destination during rclone sync or copy operations, enabling unauthorized deletion or manipulation of remote files.

Affected Products

rclone versions prior to 1.75.0
Deployments using nondefault FTP filename encoding in backend/ftp/ftp.go
Integrations relying on the github.com/jlaffaye/ftp library through rclone

Discovery Timeline

2026-08-05 - CVE-2026-71311 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71311

Vulnerability Analysis

The flaw is a CRLF injection in the FTP backend that maps to [CWE-93] Improper Neutralization of CRLF Sequences. FTP uses a line-oriented control channel where each command terminates with CRLF. When rclone processes a filename for an FTP STOR, RETR, or DELE argument, the configured encoder is applied. A nondefault user-configured encoding can convert previously escaped symbols back to raw CR or LF bytes.

The downstream FTP client library, github.com/jlaffaye/ftp, formats these arguments through textproto.Conn.Cmd without validating for line terminators. The result is that a single filename argument can be interpreted as multiple commands by the server. An attacker who plants a crafted filename on a low-privilege source then waits for a victim to sync that file to a higher-privilege FTP destination.

Root Cause

The root cause is missing sanitization of CR and LF characters in filenames after user-configured encoding is applied. The default encoder escaped these bytes, but nondefault encodings could reintroduce them. Because the FTP client library did not defensively reject CR/LF in command arguments, the filename could break out of its argument slot on the FTP control channel and inject a second command executed under the victim's authenticated session.

Attack Vector

Exploitation requires an attacker to control a filename on a source location that a victim will later sync or copy to a more-privileged FTP destination using rclone. User interaction is required because the victim must initiate the sync operation. The injected command executes with the victim's FTP credentials on the destination server.

// Patch: backend/ftp/ftp.go
// commandEncoding hardens the user-configured filename encoding so that it
// can never restore a raw CR or LF.
//
// The FTP control channel is line oriented and the ftp library writes command
// arguments (paths) straight onto it without escaping, so a filename
// containing CR/LF would otherwise be able to inject an independent FTP
// command. CR/LF are therefore always encoded to safe symbols regardless of
// the configured encoding, which is what the default encoding already does.
func commandEncoding(enc encoder.MultiEncoder) encoder.MultiEncoder {
	return enc | encoder.EncodeCrLf
}

Source: rclone commit 1df2b70. The patch forces EncodeCrLf on the encoder used for FTP command arguments regardless of the user-configured encoding.

Detection Methods for CVE-2026-71311

Indicators of Compromise

Filenames on FTP-accessible storage containing embedded CR (0x0D) or LF (0x0A) byte sequences.
FTP server logs showing unexpected DELE, RNFR, RNTO, or STOR commands issued in the same session as a rclone-driven transfer.
rclone log entries referencing nondefault FTP encoding settings that omit EncodeCrLf.

Detection Strategies

Audit FTP server command logs for command sequences that do not match the expected rclone client behavior of a single file operation per line.
Inventory file listings on FTP shares and object stores that feed rclone jobs, flagging any filenames containing control characters.
Review rclone configuration files for the encoding option on FTP remotes and identify entries that remove default protections.

Monitoring Recommendations

Enable verbose FTP server audit logging that records the raw command line, including any CR/LF injected bytes.
Alert on unexpected DELE or rename operations executed against sensitive FTP directories during scheduled sync windows.
Correlate rclone process execution telemetry with FTP server session logs to identify command volume anomalies per session.

How to Mitigate CVE-2026-71311

Immediate Actions Required

Upgrade rclone to version 1.75.0 or later on all systems that use the FTP backend.
Inventory FTP remotes in rclone.conf and identify any that use nondefault encoding values.
Scan source storage for filenames containing CR or LF bytes and remove or rename them before syncing to privileged destinations.

Patch Information

The fix is available in rclone 1.75.0. See GitHub Release Tag v1.75.0 and the GitHub Security Advisory GHSA-8c48-q9wj-3w37. The patched commandEncoding function in backend/ftp/ftp.go unconditionally applies encoder.EncodeCrLf to command arguments.

Workarounds

Revert FTP remote configurations to the default filename encoding, which already escapes CR and LF.
Restrict rclone FTP sync jobs to sources where filenames are controlled by trusted parties only.
Where possible, transfer files using SFTP or another protocol that is not vulnerable to line-oriented command injection.

bash

# Verify rclone version is patched
rclone version

# Inspect FTP remote configuration for nondefault encoding
rclone config show | grep -A5 'type = ftp'

# Search source directory for filenames containing CR or LF
find /path/to/source -name $'*\r*' -o -name $'*\n*'