CVE-2026-116191 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

What is CVE-2026-116191?

CVE-2026-116191 is a high-severity vulnerability in rclone, published on 25 Oct 2026.

Official description

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

Weakness: CWE-22

Which versions are affected by CVE-2026-116191?

1 open source package ship an affected version, including rclone. It affects 1 product.

Products include Rclone Rclone.

How do I fix CVE-2026-116191?

Upgrade rclone to 1.75.2 or later.

Is CVE-2026-116191 being exploited?

There is no known exploitation of CVE-2026-116191 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in rclone

• CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass Critical 9.8
• CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix Critical 9.8
• CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution Critical 9.2
• CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution Critical 9.2
• CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as BIT-rclone-2026-116191, DEBIAN-CVE-2026-116191, GHSA-44pm-2q5p-fm63, GHSA-4fcc-gp7q-gf9r, UBUNTU-CVE-2026-116191.