The vulnerability exists in the rclone serve docker volume plugin where the newVolume() function constructs a volume's mountpoint path by joining a base directory with an attacker-controlled volume name without validating that the resulting path remains within the base directory. This allows path traversal via volume names containing '..' components, enabling an attacker with access to submit VolumeDriver.Create requests to cause the privileged rclone plugin process to create directories and mount remote filesystems at arbitrary host paths, potentially disrupting or shadowing system directories. The same missing validation was present in Volume.restoreState() when reloading persisted volume state. The issue affects rclone versions 1.56.0 through 1.75.0 and was fixed in version 1.75.1.

An attacker able to submit VolumeDriver.Create requests to the rclone serve docker volume plugin socket can cause the plugin to create directories and mount remote filesystems at arbitrary locations on the host filesystem outside the intended base directory. This can lead to disruption or shadowing of system directories. The vulnerability requires local or orchestrated access to the Docker volume plugin socket and privileges to request named volumes. The CVSS score is 3.4 (medium severity) with low confidentiality impact, limited integrity impact, and limited availability impact.

Upgrade rclone to version 1.75.1 or later where this path traversal vulnerability is fixed. Until upgraded, restrict access to the rclone serve docker volume plugin socket to trusted users and workloads only to prevent unauthorized VolumeDriver.Create requests.