CVE-2026-71312: rclone SFTP PowerShell RCE Vulnerability

CVE-2026-71312 Overview

CVE-2026-71312 is a command injection vulnerability in rclone, a command-line program used to sync files and directories across cloud storage providers. Versions prior to v1.75.0 interpolate remote SFTP paths into PowerShell hash commands within backend/sftp/sftp.go. The quoteOrEscapeShellPath function escapes only the ASCII apostrophe, ignoring the Unicode smart quotes U+2018, U+2019, U+201A, and U+201B that PowerShell also accepts as single-quote delimiters. An attacker who controls a filename on the remote can terminate the intended path literal and append PowerShell statements that execute under the victim's SSH account when server-side hashing is invoked.

Critical Impact
An attacker-controlled filename on a PowerShell SFTP remote can achieve arbitrary command execution as the victim SSH account during server-side hashing operations.

Affected Products

rclone versions prior to v1.75.0
Deployments using SFTP remotes configured with PowerShell as the server-side shell
Sync workflows that invoke server-side hashing against attacker-influenced filenames

Discovery Timeline

2026-08-05 - CVE-2026-71312 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71312

Vulnerability Analysis

The flaw resides in backend/sftp/sftp.go, where rclone builds PowerShell command strings that include remote file paths. The helper quoteOrEscapeShellPath wraps the path in ASCII single quotes and doubles any embedded ASCII apostrophes. PowerShell, however, additionally accepts four Unicode code points as single-quote string delimiters: the left single quotation mark (U+2018), right single quotation mark (U+2019), single low-9 quotation mark (U+201A), and single high-reversed-9 quotation mark (U+201B). Any of these Unicode characters in a filename closes the surrounding string literal, allowing an attacker to append PowerShell statements. This condition is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Root Cause

The escaping routine assumed PowerShell recognized only the ASCII apostrophe as a string delimiter. The function performed a single strings.ReplaceAll targeting ', leaving the Unicode smart quotes unmodified. Because PowerShell parses those code points identically to the ASCII apostrophe when they appear at the boundary of a quoted string, the neutralization was incomplete for any filename originating from a system that permits Unicode names.

Attack Vector

Exploitation requires the victim to run rclone against an SFTP remote whose configured shell is PowerShell and to trigger a server-side hash operation on a file with a crafted name. The attacker plants a filename containing one of the Unicode smart quotes followed by a PowerShell payload. When rclone constructs the hash command, the payload is interpolated outside the intended quoted argument and executes with the privileges of the SSH account rclone authenticated as.

// Patch: backend/sftp/sftp.go
// Source: https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88

// powerShellQuoteEscaper doubles every character PowerShell accepts as a
// single-quote string delimiter. As well as the ASCII apostrophe, PowerShell
// treats the Unicode smart quotes U+2018, U+2019, U+201A and U+201B as single
// quotes, so a path wrapped in apostrophes must double all of them or an
// attacker controlled filename could close the literal and inject a statement.
var powerShellQuoteEscaper = strings.NewReplacer(
    "'", "''",
    "\\u2018", "\\u2018\\u2018",
    "\\u2019", "\\u2019\\u2019",
    "\\u201A", "\\u201A\\u201A",
    "\\u201B", "\\u201B\\u201B",
)

// quoteOrEscapeShellPath makes path a valid string argument in configured shell
func quoteOrEscapeShellPath(shellType string, shellPath string) (string, error) {
    // PowerShell
    if shellType == "powershell" {
        return "'" + powerShellQuoteEscaper.Replace(shellPath) + "'", nil
    }
    // Windows Command Prompt
    if shellType == "cmd" {
        // ...
    }
}

The patch replaces the single strings.ReplaceAll call with a strings.NewReplacer that doubles all five delimiter characters, restoring the PowerShell escape convention for each accepted quote form.

Detection Methods for CVE-2026-71312

Indicators of Compromise

Filenames on SFTP servers that contain the Unicode code points U+2018, U+2019, U+201A, or U+201B in unexpected positions
PowerShell process trees spawned by an sshd session where the parent command line references rclone hashing operations
Unexpected outbound network connections or file writes originating from the SSH login shell shortly after an rclone hash sync completes

Detection Strategies

Inspect rclone-generated PowerShell command strings sent over SFTP for embedded Unicode smart quotes prior to the closing apostrophe
Alert on PowerShell child processes launched under sshd accounts that execute commands outside the expected Get-FileHash pattern
Correlate rclone client logs with server-side shell history to identify hash commands whose arguments contain non-ASCII quote code points

Monitoring Recommendations

Log and review PowerShell script block execution (Event ID 4104) on servers that expose SFTP with a PowerShell subsystem
Track rclone client versions across the fleet and flag any host still running a release below v1.75.0
Monitor SFTP servers for new files whose names contain non-ASCII punctuation and route them for review before sync operations run

How to Mitigate CVE-2026-71312

Immediate Actions Required

Upgrade all rclone installations to v1.75.0 or later, which contains the fix in commit e122fba1a57641b63a580aa26c026903a84e2e88
Audit SFTP remote configurations and identify any that specify powershell as the shell type
Restrict rclone SSH accounts to the least privilege required for their sync targets to limit blast radius if a payload executes

Patch Information

The fix is included in the rclone v1.75.0 release. Details of the change are documented in the GitHub Security Advisory GHSA-2m8m-jhrm-w6j2 and the upstream commit.

Workarounds

Disable server-side hashing on SFTP remotes that use PowerShell until the upgrade is applied
Switch the configured shell on affected SFTP remotes to a non-PowerShell option where operationally feasible
Reject or rename files containing Unicode smart quotes on SFTP servers accessed by rclone clients

bash

# Verify installed rclone version and upgrade
rclone version

# Example: temporarily disable server-side hash checks on an SFTP remote
rclone sync src: dst: --sftp-disable-hashcheck

# After upgrade, confirm the fixed release
rclone version | grep -E "v1\.(7[5-9]|[89][0-9])"