CVE-2026-79781

MEDIUM 6.5

rclone serve s3 Path Traversal via dot-dot object keys

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.

CWE	CWE-22
Vendor	rclone
Product	rclone
Published	Aug 25, 2026
Last Updated	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for rclone rclone

Be the first to know when new medium vulnerabilities affecting rclone rclone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

rclone / rclone

0 < 1.74.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v vulncheck.com: https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

Credits

🔍 Dangel165 ncw