Listen to this Post
rclone core fails to sanitize parent-directory segments (..) in a source object’s `Remote()` value before that name is passed to destination backends. Nothing in fs/march, fs/sync, fs/list, or `fs/operations` rejects `..` segments, so confinement is delegated to each backend. When a source is a flat-keyspace object store that can hold a raw `..` key, a crafted object name reaches a destination backend’s Put/Update/Mkdir and can escape the configured root.
The flaw splits into two classes. Bucket-based backends call bucket.Split(path.Join(f.root, rootRelativePath)): b2 (backend/b2/b2.go:404), swift (backend/swift/swift.go:464), qingstor (backend/qingstor/qingstor.go:198), oracleobjectstorage (backend/oracleobjectstorage/oracleobjectstorage.go:245), internetarchive (backend/internetarchive/internetarchive.go:1016), smb (backend/smb/smb.go:885), and storj (backend/storj/fs.go:289). `path.Join` collapses `..` on the standard ASCII form before encoding is applied, so `EncodeDot` never neutralizes the segment. `lib/bucket.Join` does not clean paths and keeps `..` as a literal key segment, while `path.Join` does clean them. S3, azureblob, and googlecloudstorage already use `bucket.Join` and are not affected.
Path-based backends call `path.Join(root, remote)` onto a real filesystem path. sftp uses `remotePath = path.Join(f.absRoot, f.opt.Enc.FromStandardPath(remote))` (backend/sftp/sftp.go:2497). With the default `encoder.Display` encoding, `FromStandardPath` passes through unchanged, so `..` survives and `path.Join(“/home/user/root”, “../../../../etc/passwd”)` resolves to /etc/passwd. webdav joins at backend/webdav/webdav.go:426-432, ftp joins at roughly 14 sites (e.g. backend/ftp/ftp.go:1247), and filelu, shade, and sia perform analogous joins.
Reachability requires a source that is a flat-keyspace object store (a local, sftp, or smb source cannot represent `../../x` as one directory entry) and a key written with native, non-rclone tooling. rclone’s own writer applies `EncodeDot` and rewrites a `..` segment to fullwidth ．．, so such a key cannot be created through rclone. rclone’s source-side listing does pass a natively planted raw `..` key through unchanged; this has been verified for b2 (remote := file.Name[len(prefix):] after ToStandardPath, backend/b2/b2.go:858,867).
The blast radius is the victim’s own account — a bucket, share, or path the configured credential already reaches. This is integrity misdirection, not a cross-tenant or confidentiality breach. sftp and smb are exceptions in reach (server filesystem or another share), still bounded by the login’s own permissions. This is the same class as the already-fixed local backend advisory GHSA-7p4m-qxvv-g567 (CVE-2026-71313), which added `(Fs).localPath` returning `errPathEscapes` for names resolving outside the root (backend/local/local.go:819-826).
DailyCVE Form:
Platform: rclone
Version: prior 1.75.1
Vulnerability: path traversal
Severity: Medium
date: 2026-09-10
Prediction: Patched 1.75.1
What Undercode Say
Analytics
Verify raw .. key passes through b2 source listing grep -n "ToStandardPath" backend/b2/b2.go | head line 858: remote := file.Name[len(prefix):] Confirm path.Join collapses .. before encoding grep -n "FromStandardPath(path.Join" backend/b2/b2.go line 1641 Check sftp default encoding pass-through grep -n "FromStandardPath" backend/sftp/sftp.go line 2497: path.Join(f.absRoot, f.opt.Enc.FromStandardPath(remote))
Exploit: (Educational Purposes!)
Step 1 — attacker, using NATIVE S3 tooling (NOT rclone)
aws s3api put-object --bucket shared-drop --key '../../victim-backups/pwned.txt' --body evil.txt
Step 2 — victim's ordinary ingest
rclone copy s3-drop:shared-drop b2:victim-uploads/incoming
path.Join("victim-uploads/incoming", "../../victim-backups/pwned.txt")
= "victim-backups/pwned.txt"
→ lands in victim-backups bucket instead of under incoming/
Protection: from this CVE
Upgrade to rclone 1.75.1 or later. Audit source credentials to ensure they cannot reach sibling buckets, shares, or paths outside the intended destination. For sftp and smb, restrict login permissions to the narrowest root possible. Where feasible, avoid ingesting from flat-keyspace object stores that may contain natively planted `..` keys.
Impact:
Integrity misdirection within the victim’s own account. A crafted source object name can cause a write to land in a different bucket, share, or path than the operator intended, potentially overwriting or planting files in locations the configured credential can reach. No cross-tenant or confidentiality breach is demonstrated. sftp and smb extend the reach to the server filesystem or another share, still bounded by the login’s permissions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
