Vulnerability · Published Aug 5, 2026 · Assigned by GitHub_M

CVE-2026-71312rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

High 8.0

In plain English

A high-severity OS command injection in rclone from rclone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rclone	no fix listed	DEBIAN-CVE-2026-71312
Debian:13	rclone	no fix listed	DEBIAN-CVE-2026-71312
Go	github.com/rclone/rclone	1.75.0	GHSA-2m8m-jhrm-w6j2
Go	github.com/rclone/rclone	1.75.0	GO-2026-6182
Ubuntu:26.10	rclone	no fix listed	UBUNTU-CVE-2026-71312

Affected products (as reported)

Vendor	Product	Versions
rclone	rclone	< 1.75.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2 x_refsource_CONFIRM
https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88 x_refsource_MISC
https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC