CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys
Attackers can read and overwrite root-level files by using dot-dot segments in S3 object keys when using rclone serve s3.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79781?
CVE-2026-79781 is a medium-severity path traversal vulnerability in rclone, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-79781?
4 open source packages ship an affected version, including github.com/rclone/rclone and rclone.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | All versions | 1.74.4 |
github.com/rclone/rclone Go | All versions | 1.74.4 |
github.com/rclone/rclone Go | All versions | 1.74.4 |
rclone Bitnami | All versions | 1.74.4 |
How do I fix CVE-2026-79781?
Upgrade github.com/rclone/rclone to 1.74.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-79781 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79781 exists.
Sources
Also known as BIT-rclone-2026-79781, DEBIAN-CVE-2026-79781, GHSA-8v25-v8p6-qf7v, GHSA-98fh-ch8q-6529, GO-2026-6189, MINI-262f-j9xw-96jm and 6 more.