Log in Start free

rclone

Products

ProductCVEsExploitedLatest
rclone42–Oct 25, 2026

Exploited and recent CVEs

  • CVE-2026-116196 Medium 5.3 Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url <0.1%
  • CVE-2026-116195 Medium 6.1 Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim 0.2%
  • CVE-2026-116194 Medium 6.8 Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback 0.1%
  • CVE-2026-116193 Medium 5.3 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests 0.2%
  • CVE-2026-116192 Medium 5.9 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots 0.2%
  • CVE-2026-116191 High 7.5 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL 0.4%
  • CVE-2026-116190 Low 3.7 rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect 0.2%
  • CVE-2026-116189 High 7.5 rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS 0.1%
  • CVE-2026-116188 Medium 5.3 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow 0.3%
  • CVE-2026-116187 Medium 5.0 Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads 0.1%
  • CVE-2026-93987 Low 3.4 rclone serve docker Path Traversal via Volume Name 0.2%
  • CVE-2026-93986 Low 3.1 rclone before 1.75.1 Path Traversal via Directory Listing Names 0.3%
  • CVE-2026-88046 Medium 5.3 rclone: source object names can escape the configured root on upload 0.3%
  • CVE-2026-88045 High 7.5 rclone: S3 multipart declared-length memory exhaustion 0.6%
  • CVE-2026-88044 Critical 9.1 rclone: RC per-server auth-proxy bypass 0.5%
  • CVE-2026-88018 Critical 9.8 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass 0.5%
  • CVE-2026-88017 High 7.3 rclone: FTP cross-session auth-proxy backend confusion 0.2%
  • CVE-2026-88016 High 7.1 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination 0.2%
  • CVE-2026-88015 Medium 5.3 rclone local: crafted Range request against a translated symlink panics (DoS) 0.4%
  • CVE-2026-88014 Medium 6.3 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace 0.2%
  • CVE-2026-88013 Low 3.7 rclone: http backend forwards custom/auth headers to a different host on redirect 0.2%
  • CVE-2026-79783 Low 3.6 rclone before 1.74.4 Privilege Escalation via setuid Metadata 0.2%
  • CVE-2026-79782 Low 3.1 rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect 0.1%
  • CVE-2026-79781 Medium 6.5 rclone serve s3 Path Traversal via dot-dot object keys 0.3%
  • CVE-2026-79780 Medium 5.3 rclone before v1.75.0 Credential Exposure via S3 Redirect 0.1%
  • CVE-2026-79779 Medium 5.3 rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect 0.1%
  • CVE-2026-79778 Medium 5.3 rclone before v1.75.0 Denial of Service via TUS nil-response panic 0.3%
  • CVE-2026-79777 Low 2.7 rclone before v1.75.0 Information Disclosure via RC API 0.3%
  • CVE-2026-79776 Medium 5.3 rclone before 1.75.0 Authentication Bypass via pprof 0.4%
  • CVE-2026-79775 Medium 6.5 rclone Archive Backend SquashFS Parser Denial of Service 0.4%