CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic
An attacker can escape the configured root directory in rclone serve restic to read, modify, or delete files outside the intended scope.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71309?
CVE-2026-71309 is a high-severity path traversal vulnerability in rclone, published on 5 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-71309?
4 open source packages ship an affected version, including github.com/rclone/rclone and rclone.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | All versions | 1.75.0 |
github.com/rclone/rclone Go | From 1.40.0 | 1.75.0 |
github.com/rclone/rclone Go | From 1.40.0 | 1.75.0 |
rclone Bitnami | From 1.40.0 | 1.75.0 |
How do I fix CVE-2026-71309?
Upgrade github.com/rclone/rclone to 1.75.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-71309 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71309 exists.
Sources
Also known as BIT-rclone-2026-71309, DEBIAN-CVE-2026-71309, GHSA-45pq-889g-fcgh, GO-2026-6184, MINI-3hj9-rc4q-jw39, MINI-49cg-mmww-p4gx and 8 more.