CVE-2026-116191

HIGH 7.5

Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

CWE	CWE-22
Vendor	rclone
Product	rclone
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for rclone rclone

Be the first to know when new high vulnerabilities affecting rclone rclone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

rclone / rclone

0 < 1.75.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63 vulncheck.com: https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol

Credits

🔍 euriconicacio manus-pi ncw