CVE-2018-12907 Server-side request forgery in n/a
Attackers can trigger transmission of arbitrary URL content to Google Cloud Storage via unvalidated URL fields in Rclone sync operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12907?
CVE-2018-12907 is a high-severity server-side request forgery vulnerability in n/a, published on 27 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google, because there is no validation of a URL field received from the Google Cloud Storage API server, aka a "RESTLESS" issue.
Weakness: CWE-200
Which versions are affected by CVE-2018-12907?
It affects 1 product.
Products include Rclone Rclone.
How do I fix CVE-2018-12907?
No fix has been published for CVE-2018-12907 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-12907 being exploited?
There is no known exploitation of CVE-2018-12907 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
- CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Sources
Also known as GHSA-583j-w294-52g8.