{"kind": "product", "path": "vulns/ubuntu-18.04-lts/rclone", "name": "rclone", "product": "rclone", "ecosystem": "Ubuntu:18.04:LTS", "items": [{"id": "CVE-2026-116196", "noindex": false, "published": "2026-10-25T13:20:29.804Z", "modified": "2026-10-25T13:20:29.804Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00063, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116196", "title": "Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url", "description": "Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Attackers can observe a same-host HTTPS-to-HTTP downgrade redirect to capture the cleartext B2 token, or receive cross-host redirects disclosing SSE-C customer encryption keys.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72", "https://www.vulncheck.com/advisories/rclone-before-1.75.2-b2-credential-leak-on-redirect-via-b2-download-url", "https://nvd.nist.gov/vuln/detail/CVE-2026-116196"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116195", "noindex": false, "published": "2026-10-25T13:20:29.131Z", "modified": "2026-10-26T16:42:00.376Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "severity": "high", "epss": 0.00229, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116195", "title": "Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim", "description": "Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827", "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink-rclonelink-suffix-trim", "https://nvd.nist.gov/vuln/detail/CVE-2026-116195"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116194", "noindex": false, "published": "2026-10-25T13:20:28.466Z", "modified": "2026-10-29T16:18:52.204Z", "cvss": 7.6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0012, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116194", "title": "Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback", "description": "Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46", "https://www.vulncheck.com/advisories/rclone-1.52.0-before-1.75.2-csrf-via-pcloud-oauth-callback", "https://nvd.nist.gov/vuln/detail/CVE-2026-116194"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116193", "noindex": false, "published": "2026-10-25T13:20:27.801Z", "modified": "2026-10-29T20:00:59.244Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00249, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116193", "title": "Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests", "description": "Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj", "https://www.vulncheck.com/advisories/rclone-1.64.0-before-1.75.2-serve-webdav-authentication-bypass-via-options-requests", "https://nvd.nist.gov/vuln/detail/CVE-2026-116193"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116192", "noindex": false, "published": "2026-10-25T13:20:27.162Z", "modified": "2026-10-25T13:20:27.162Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116192", "title": "rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots", "description": "rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m", "https://www.vulncheck.com/advisories/rclone-from-1.37-before-1.74.2-ssrf-via-rc-serve-scheme-relative-remote-roots", "https://nvd.nist.gov/vuln/detail/CVE-2026-116192"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116191", "noindex": false, "published": "2026-10-25T13:20:26.490Z", "modified": "2026-10-26T16:42:11.109Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00393, "kev": false, "exploits": ["github-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116191", "title": "Rclone before 1.75.2 Path Traversal via serve webdav MKCOL", "description": "Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63", "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol", "https://nvd.nist.gov/vuln/detail/CVE-2026-116191"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116190", "noindex": false, "published": "2026-10-25T13:20:25.832Z", "modified": "2026-10-29T16:17:28.780Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00189, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116190", "title": "rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect", "description": "rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v", "https://www.vulncheck.com/advisories/rclone-1.56.0-before-1.75.2-webdav-credential-header-leak-on-redirect", "https://nvd.nist.gov/vuln/detail/CVE-2026-116190"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116189", "noindex": false, "published": "2026-10-25T13:20:25.148Z", "modified": "2026-10-29T19:59:55.648Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00142, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116189", "title": "rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS", "description": "rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8", "https://www.vulncheck.com/advisories/rclone-1.55.0-before-1.75.2-selfupdate-signature-verification-bypass-via-sha256sums", "https://nvd.nist.gov/vuln/detail/CVE-2026-116189"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116188", "noindex": false, "published": "2026-10-25T13:20:24.506Z", "modified": "2026-10-25T13:20:24.506Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00253, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116188", "title": "rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow", "description": "rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-qjw8-8hmp-c3m6", "https://www.vulncheck.com/advisories/rclone-serve-s3-1.75.0-before-1.75.2-memory-limit-bypass-via-multipart-overflow", "https://nvd.nist.gov/vuln/detail/CVE-2026-116188"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-116187", "noindex": false, "published": "2026-10-25T13:20:23.849Z", "modified": "2026-10-26T16:42:27.522Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00143, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-116187", "title": "Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads", "description": "Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5", "https://www.vulncheck.com/advisories/rclone-1.68.0-before-1.75.2-authorization-bypass-in-serve-s3-multipart-uploads", "https://nvd.nist.gov/vuln/detail/CVE-2026-116187"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-93987", "noindex": false, "published": "2026-09-19T11:53:38.413Z", "modified": "2026-09-21T18:29:11.792Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00151, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93987", "title": "rclone serve docker Path Traversal via Volume Name", "description": "rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name` field of a Docker VolumeDriver.Create request without verifying that the result stays within drv.root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file.MkdirAll before mounting. A volume name containing enough `..` components (e.g. \"../../../../../../etc\") therefore resolves outside the base directory, allowing anyone able to submit a ", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-p6vx-hf7p-98j6", "https://www.vulncheck.com/advisories/rclone-serve-docker-path-traversal-via-volume-name", "https://nvd.nist.gov/vuln/detail/CVE-2026-93987"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-93986", "noindex": false, "published": "2026-09-19T11:53:37.737Z", "modified": "2026-09-21T20:46:58.617Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00288, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93986", "title": "rclone before 1.75.1 Path Traversal via Directory Listing Names", "description": "rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q", "https://www.vulncheck.com/advisories/rclone-before-1.75.1-path-traversal-via-directory-listing-names", "https://nvd.nist.gov/vuln/detail/CVE-2026-93986"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88046", "noindex": false, "published": "2026-09-10T16:14:49.587Z", "modified": "2026-09-15T14:47:32.868Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88046", "title": "rclone: source object names can escape the configured root on upload", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination backends. A flat-keyspace source object store populated with native non-rclone tooling can contain a raw .. key segment, and affected b2, swift, qingstor, oracleobjectstorage, internetarchive, smb, storj, sftp, webdav, ftp, filelu, shade, and sia destinations use path.Join(root, remote) before EncodeDot can neutralize the segment. A copy or upload c", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252", "https://github.com/rclone/rclone/releases/tag/v1.75.1"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88045", "noindex": false, "published": "2026-09-10T16:11:39.800Z", "modified": "2026-09-10T17:31:43.950Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0063, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88045", "title": "rclone: S3 multipart declared-length memory exhaustion", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or hos", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f", "https://github.com/rclone/rclone/issues/9616", "https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88044", "noindex": false, "published": "2026-09-10T16:08:14.619Z", "modified": "2026-09-10T17:14:40.559Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.00492, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88044", "title": "rclone: RC per-server auth-proxy bypass", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj", "https://github.com/rclone/rclone/commit/739403963abf6f58003c2becd5f7c4ad0d644153", "https://github.com/rclone/rclone/releases/tag/v1.75.1"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88016", "noindex": false, "published": "2026-09-10T15:53:39.550Z", "modified": "2026-09-15T14:44:03.614Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "severity": "high", "epss": 0.00187, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88016", "title": "rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory ", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh", "https://github.com/rclone/rclone/commit/17b0c03338a857bcb0a68d2d4c82ddbdec3f7893", "https://github.com/rclone/rclone/commit/a7ab39d3d1958afa1446982c1dc4e4a73a887e3e"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88015", "noindex": false, "published": "2026-09-10T15:50:41.414Z", "modified": "2026-09-10T16:01:48.110Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00359, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88015", "title": "rclone local: crafted Range request against a translated symlink panics (DoS)", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than te", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw", "https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9", "https://github.com/rclone/rclone/releases/tag/v1.75.1"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88014", "noindex": false, "published": "2026-09-10T15:48:32.953Z", "modified": "2026-09-10T16:12:36.643Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "severity": "medium", "epss": 0.00151, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88014", "title": "rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently ", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q", "https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0", "https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-88013", "noindex": false, "published": "2026-09-10T15:39:56.206Z", "modified": "2026-09-10T16:12:49.701Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00187, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-88013", "title": "rclone: http backend forwards custom/auth headers to a different host on redirect", "description": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat, download, mount, and serv", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-486v-q2wf-fp2r", "https://github.com/rclone/rclone/commit/22859b7e696cea3c563c6ba04c6b7f91f74456b4", "https://github.com/rclone/rclone/commit/79fbc0842f74e02cb84f0e3e7261d169983c8831"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}, {"id": "CVE-2026-79783", "noindex": false, "published": "2026-08-25T15:16:11.806Z", "modified": "2026-08-25T16:11:49.885Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00227, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-79783", "title": "rclone before 1.74.4 Privilege Escalation via setuid Metadata", "description": "rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.", "references": ["https://github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw", "https://www.vulncheck.com/advisories/rclone-before-privilege-escalation-via-setuid-metadata", "https://nvd.nist.gov/vuln/detail/CVE-2026-79783"], "fixes": [], "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}]}], "total": 37, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "rclone", "path": "vulns/ubuntu-18.04-lts/rclone", "ecosystem": "Ubuntu:18.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 10, "kev": 0}, "lastmod": "2026-10-29T20:00:59.244Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}