Vulnerabilities in rclone
42 resultsCVE-2026-93986LOWrclone before 1.75.1 Path Traversal via Directory Listing NamesEPSS 0.3%CVE-2026-79778MEDIUMrclone before v1.75.0 Denial of Service via TUS nil-response panicEPSS 0.3%CVE-2026-59732MEDIUMrclone archive extract allows S3 destination prefix escape via crafted archive pathsEPSS 0.3%CVE-2026-116188MEDIUMrclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart OverflowEPSS 0.3%CVE-2026-116193MEDIUMRclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS RequestsEPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2026-88017HIGHrclone: FTP cross-session auth-proxy backend confusionEPSS 0.2%CVE-2026-116195HIGHRclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix TrimEPSS 0.2%CVE-2026-79783LOWrclone before 1.74.4 Privilege Escalation via setuid MetadataEPSS 0.2%CVE-2026-116192HIGHrclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote rootsEPSS 0.2%CVE-2026-116190MEDIUMrclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on RedirectEPSS 0.2%CVE-2026-88016HIGHrclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationEPSS 0.2%CVE-2026-88013LOWrclone: http backend forwards custom/auth headers to a different host on redirectEPSS 0.2%CVE-2026-93987MEDIUMrclone serve docker Path Traversal via Volume NameEPSS 0.2%CVE-2026-88014MEDIUMrclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespaceEPSS 0.2%CVE-2026-79780MEDIUMrclone before v1.75.0 Credential Exposure via S3 RedirectEPSS 0.1%CVE-2026-116187MEDIUMRclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart UploadsEPSS 0.1%CVE-2026-116189HIGHrclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMSEPSS 0.1%CVE-2026-79782CRITICALrclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP RedirectEPSS 0.1%CVE-2026-116194HIGHRclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth CallbackEPSS 0.1%