CVE-2026-79781Medium· 6.5▾ Sunlitrclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-sec…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.3%
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/rclone/rclone < 1.74.4Patched in:
github.com/rclone/rclone 1.74.4Source: https://osv.dev/vulnerability/GHSA-8v25-v8p6-qf7v
Connected by shared product, vendor, weakness, or advisory.
GHSA-8v25-v8p6-qf7vMedium· 6.5rclone: Path traversal in serve s3 allows reading and overwriting root-level files
GO-2026-6189NonePath traversal in serve s3 in github.com/rclone/rclone
CVE-2026-59732Medium· 5.0rclone archive extract allows S3 destination prefix escape via crafted archive paths
CVE-2026-79779Medium· 5.3rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects
CVE-2026-79780Medium· 5.3rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes
CVE-2026-79782Low· 3.1rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host