Search: CVE-2026-41179

Rclone versions from 1.48.0 up to but not including 1.73.5 contain a critical vulnerability in the Remote Control (RC) endpoint operations/fsinfo. This endpoint is exposed without authentication and accepts attacker-controlled input that allows instantiation of malicious backends. Specifically, the WebDAV backend executes a command during initialization, enabling unauthenticated local command execution on deployments where the RC server is running without authentication. The issue is patched in version 1.73.5.