{"id":"CVE-2026-116191","title":"Rclone before 1.75.2 Path Traversal via serve webdav MKCOL","summary":"Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"rclone","product":"rclone","affected":["rclone < 1.75.2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-26T15:43:15.573699Z"},"exploitAvailable":true,"published":"2026-10-25","updated":"2026-10-26","sourceUpdated":"2026-10-26T16:42:11.109Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116191","references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63","label":"GitHub Security Advisory (GHSA-44pm-2q5p-fm63)"},{"url":"https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol","label":"VulnCheck Advisory: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116191.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-116191"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560410"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116191"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116191"}],"tags":["cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00388,"epssPercentile":0.32723,"exploits":{"github":1,"githubRepos":["https://github.com/asvorg/CVE-2026-116191-poc"],"checkedAt":"2026-10-27T16:59:05.381Z"},"ingestedAt":"2026-10-25T22:08:29.943Z","slug":"CVE-2026-116191","body":"## Overview\n\nRclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.\n\n## Affected\n\n- `rclone < 1.75.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-116191.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":229402,"id":"CVE-2026-116191","ts":1793019744226,"field":"exploit_available","old":"false","new":"true"}]}