Threats affecting pkg:golang/rclone

Rclone versions before 1.75.2 have a vulnerability in the b2 backend that exposes sensitive credentials. This flaw leaks the live account Authorization token and SSE-C encryption keys during HTTP redirects from --b2-download-url hosts. Attackers can exploit HTTPS-to-HTTP downgrade redirects on the same host or cross-host redirects to capture these credentials in cleartext.

Rclone versions prior to 1.75.2 have a path traversal vulnerability in the local backend's translateLink function. This flaw allows an attacker to bypass directory containment checks by exploiting how the .rclonelink suffix is trimmed after the containment verification. An attacker can create a specially named directory in a source tree synced with --links and --metadata options to manipulate ownership, timestamps, and extended attributes of the destination's parent directory.

Rclone versions from 1.52.0 up to but not including 1.75.2 contain a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback. This flaw disables the state check and trusts the hostname parameter, allowing malicious web pages to send unauthorized requests to port 53682 during authorization. Attackers can plant tokens and API hosts, causing subsequent transfers to be redirected to attacker-controlled endpoints. The vulnerability is fixed in version 1.75.2.

Rclone versions from 1.64.0 up to but not including 1.75.2 contain an authentication bypass vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS requests. Exploitation enables attackers to probe arbitrary paths and use the Allow header values to determine the existence of files or collections, effectively allowing namespace enumeration.

rclone versions from 1.37 up to but not including 1.74.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to redirect HTTP and NetStorage backend requests by supplying a double-slash root on an existing named remote via the --rc-serve option. Exploitation enables attackers to make HEAD or GET requests to attacker-chosen hosts, potentially reading responses, capturing configured custom headers, or obtaining valid NetStorage request signatures. The vulnerability is fixed in rclone version 1.74.2.

Rclone versions before 1.75.2 have a path traversal vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to write files outside the intended served root directory by using unvalidated '..' path components. Exploitation involves sending MKCOL /.. requests to create virtual filesystem nodes, followed by PUT, MOVE, COPY, or MKCOL operations to manipulate files belonging to other tenants.

rclone versions from 1.56.0 up to but not including 1.75.2 contain an information disclosure vulnerability in the WebDAV backend. This flaw causes custom credential headers configured by the operator to be forwarded to different hosts during HTTP 3xx redirects. An attacker who can control or influence such redirects may capture sensitive headers like X-Auth-Token and reuse them against the original WebDAV service. The issue is fixed in version 1.75.2.

CVE-2026-116189 is a vulnerability in rclone versions from 1.55.0 up to but not including 1.75.2. It involves improper verification of cryptographic signatures in the stable selfupdate mechanism. The flaw allows attackers who control the release distribution path to prepend an unsigned checksum line that matches a malicious archive. This causes the selfupdate process to install an attacker-controlled rclone executable, bypassing signature verification.

An integer overflow vulnerability exists in rclone serve s3 versions 1.75.0 through 1.75.1 in the multipart reorder-memory accounting. This flaw allows attackers to bypass the configured buffer limit by opening two concurrent current-part PUT requests with large declared lengths, causing the signed int64 counter to wrap and enabling retention of out-of-order parts in memory, which can exhaust system resources.

Rclone versions from 1.68.0 up to but not including 1.75.2 contain an authorization bypass vulnerability in the serve s3 --auth-proxy feature. This flaw allows authenticated tenants to manipulate multipart uploads belonging to other tenants by referencing their upload IDs. Attackers who know a victim's bucket, object, and upload ID can inject parts, complete, or abort ongoing uploads and access upload and object metadata across tenants. The vulnerability is fixed in version 1.75.2.