CVE-2026-71313: rclone Path Traversal Vulnerability

CVE-2026-71313 Overview

CVE-2026-71313 is a path traversal vulnerability [CWE-22] in rclone, a command-line utility for syncing files between local storage and cloud providers. The flaw affects the local backend implemented in backend/local/local.go from version v1.51.0 through v1.74.x. When rclone uses a filename encoder that preserves characters such as /, \, or fullwidth dot sequences (Slash, None, Raw, or Windows encoders that preserve backslash), an attacker-controlled remote source object can decode into a real parent-directory component. The resulting path bypasses the intended local root during filepath.Join, allowing file creation or overwrite outside the destination directory. The issue is fixed in v1.75.0.

Critical Impact
An attacker who controls source object names on a remote can write files anywhere the rclone process has permission, enabling code overwrite, configuration tampering, and lateral compromise on the host.

Affected Products

rclone v1.51.0 through v1.74.x (local backend)
Deployments using Slash, None, or Raw filename encodings
Windows deployments using any encoding that preserves the backslash character

Discovery Timeline

2026-08-05 - CVE-2026-71313 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71313

Vulnerability Analysis

rclone's local backend relies on the configured filename encoder to sanitize remote object names before they touch the operating system path layer. The encoder is expected to translate reserved sequences, such as fullwidth dot-dot (．．) or native path separators, into safe substitutes before the name reaches filepath.Join. When operators select Slash, None, or Raw, or use a Windows encoding that preserves \, the sanitization contract is broken. A remote source name containing a standard-encoded fullwidth .. sequence, or a raw backslash on Windows, is decoded back to a real parent-directory component. filepath.Join then resolves the joined path outside the configured local root without triggering a boundary check.

Root Cause

The root cause is a mismatch between encoder guarantees and backend assumptions. The local backend assumes any dangerous path syntax is neutralized by the encoder, but several encoder options intentionally pass characters through unchanged. There is no post-join validation that the resulting file path remains within the destination root, so decoded traversal sequences reach the filesystem call.

Attack Vector

An attacker plants objects with crafted names on a remote source that the victim will sync using rclone copy or rclone sync. When the victim pulls to a local destination configured with a permissive encoder, the crafted names decode into ../ or ..\ components. Files are written outside the destination directory with the privileges of the rclone process. Exploitation requires user interaction to initiate the sync operation.

// Patch excerpt from backend/local: propagate errors from newObject
// so callers do not proceed with an object whose resolved path
// escaped the configured local root.

// Create destination
-	dstObj := f.newObject(remote)
+	dstObj, err := f.newObject(remote)
+	if err != nil {
+		return nil, err
+	}
	err = dstObj.mkdirAll()
	if err != nil {
		return nil, err

Source: rclone commit 6a69713

Detection Methods for CVE-2026-71313

Indicators of Compromise

Files created outside the configured rclone destination directory with modification times aligned to sync jobs.
Remote object names containing fullwidth dot sequences (．．), embedded /, or \ on Windows targets.
Unexpected writes to sensitive paths such as ~/.ssh/authorized_keys, ~/.bashrc, or Windows startup folders by the rclone process.
rclone log entries showing successful transfers with unusually long or path-shaped remote names.

Detection Strategies

Inventory running rclone binaries and flag any version earlier than v1.75.0 on hosts performing scheduled syncs.
Audit rclone configuration files for local_encoding values set to Slash, None, or Raw, and for Windows profiles that omit backslash escaping.
Correlate rclone process activity with file creation events in directories that are not descendants of the intended local root.

Monitoring Recommendations

Log all rclone command invocations, including source remotes and destination paths, in the endpoint telemetry pipeline.
Alert on writes by the rclone process to system directories, user profile roots, or shared configuration paths outside declared sync targets.
Track remote object name enumeration for high-entropy or encoded traversal patterns before sync jobs execute.

How to Mitigate CVE-2026-71313

Immediate Actions Required

Upgrade rclone to v1.75.0 or later on every host that performs sync operations against untrusted remotes.
Pause scheduled rclone copy and rclone sync jobs sourcing from remotes where attackers may control object names until the upgrade is complete.
Run rclone under a dedicated low-privilege account with write access limited to the intended destination directories.

Patch Information

The fix is included in rclone v1.75.0. See the GHSA-7p4m-qxvv-g567 advisory and the remediation commit for details. The patch adds error propagation from newObject and hardens the local backend so decoded names cannot escape the configured root.

Workarounds

Switch the local backend encoding option to the default value, which encodes traversal-relevant characters, until upgrading is possible.
Restrict sync sources to remotes under organizational control and validate object name inventories before running sync jobs.
Enforce filesystem-level ACLs and mandatory access controls that prevent the rclone service account from writing outside its assigned destination tree.

bash

# Verify installed rclone version and upgrade to the fixed release
rclone version

# Linux example: install v1.75.0 or later from the official installer
curl https://rclone.org/install.sh | sudo bash

# Confirm local backend encoding on existing remotes
rclone config show | grep -Ei 'encoding|type = local'