rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot… (CVE-2026-79781)

The vulnerability in rclone serve s3 prior to version 1.74.4 is a path traversal flaw that permits attackers to escape the bucket namespace by crafting object keys with '../' sequences. This allows unauthorized reading and overwriting of files at the root directory level of the server. The issue affects multiple specific versions of rclone as listed, and the CVSS 3.1 base score is 6.5, indicating a medium severity level. There are no known exploits in the wild, and the vulnerability does not require privileges or user interaction to exploit.

An attacker can read and overwrite root-level files on the server running the vulnerable rclone serve s3 instance by exploiting the path traversal vulnerability. This can lead to unauthorized disclosure and modification of sensitive files outside the intended S3 bucket namespace.

A fix is available in rclone version 1.74.4 and later. Users should upgrade to version 1.74.4 or newer to remediate this vulnerability. No vendor advisory content was provided, so patch status is inferred from the version information in the description.