CVE-2026-93987 | Low | 3.4 | 2026-09-19 | rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume… |
CVE-2026-93986 | Low | 3.1 | 2026-09-19 | rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object… |
CVE-2026-88046 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject pare… |
CVE-2026-88045 | High | 7.5 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed m… |
CVE-2026-88044 | Critical | 9.1 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC inte… |
CVE-2026-88018 | Critical | 9.8 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with… |
CVE-2026-88017 | High | 7.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driv… |
CVE-2026-88016 | High | 7.1 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --l… |
CVE-2026-88015 | Medium | 5.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or li… |
CVE-2026-88014 | Medium | 6.3 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-79783 | Low | 3.6 | 2026-08-25 | rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/s… |
CVE-2026-79782 | Low | 3.1 | 2026-08-25 | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can inter… |
CVE-2026-79781 | Medium | 6.5 | 2026-08-25 | rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in… |
CVE-2026-79780 | Medium | 5.3 | 2026-08-25 | rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved acro… |
CVE-2026-79779 | Medium | 5.3 | 2026-08-25 | rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over pl… |
CVE-2026-79778 | Medium | 5.3 | 2026-08-25 | rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transp… |
CVE-2026-79777 | Low | 2.7 | 2026-08-25 | rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, modu… |
CVE-2026-79776 | Medium | 5.3 | 2026-08-25 | rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can a… |
CVE-2026-79775 | Medium | 6.5 | 2026-08-25 | rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which… |
CVE-2026-71313 | Medium | 6.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in… |
CVE-2026-71312 | High | 8.0 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP… |
CVE-2026-71311 | Medium | 6.4 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filen… |
CVE-2026-71310 | Medium | 5.9 | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper i… |
CVE-2026-71309 | | | 2026-08-05 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic doe… |
CVE-2026-59733 | High | 8.8 | 2026-07-14 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-re… |
CVE-2026-59732 | Medium | 5.0 | 2026-07-14 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write… |
CVE-2026-54572 | High | 7.5 | 2026-07-14 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializ… |
CVE-2026-49980 | Critical | 9.8 | 2026-06-24 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve a… |
CVE-2026-41179 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1… |
CVE-2026-41176 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without… |
CVE-2024-52522 | | | 2024-11-15 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --… |
CVE-2020-28924 | High | 7.5 | 2020-11-19 | An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords wit… |
CVE-2018-12907 | High | 7.5 | 2018-06-27 | In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's co… |