{"uuid": "3a60973a-0da3-4221-8b80-024169d985e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8c48-q9wj-3w37", "type": "seen", "source": "https://gist.github.com/alon710/d60715eb4915a2fe25854150e00d6548", "content": "# CVE-2026-71311: CVE-2026-71311: FTP Command Injection via Path CRLF Injection in rclone FTP Backend\n\n> **CVSS Score:** 6.4\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71311\n\n## Summary\nA protocol-level CRLF injection vulnerability exists in rclone's FTP backend before version 1.75.0. When configured with a non-default filename encoding, rclone allows carriage return and line feed characters to pass directly into the underlying FTP client library. Because the library constructs line-oriented control commands without input validation, an attacker-controlled filename can inject arbitrary FTP commands into the session, allowing unauthorized file deletion and modification on the target server.\n\n## TL;DR\nInsecure filename encoding in rclone's FTP backend combined with lack of validation in the underlying FTP library allows attackers to inject arbitrary FTP commands via crafted filenames.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **Privileges Required**: Low (PR:L)\n- **User Interaction**: Required (UI:R)\n- **CVSS v3.1 Score**: 6.4 (Medium)\n- **Exploit Status**: Proof of Concept / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- rclone versions prior to 1.75.0 utilizing the FTP backend with non-default filename encodings\n- **rclone**: < 1.75.0 (Fixed in: `1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone installations to version 1.75.0 or later.\n- Remove non-default custom encoding options (such as 'None' or 'Slash') from rclone FTP backend configurations to restore default safety filters.\n- Restrict directory write privileges on the synchronization source to prevent untrusted users from introducing files with custom control characters.\n\n**Remediation Steps:**\n1. Identify all production nodes running rclone instances.\n2. Verify configuration files (typically located at ~/.config/rclone/rclone.conf) for custom 'encoding' parameters in FTP server definitions.\n3. Apply the v1.75.0 update across all systems.\n4. Verify compliance by attempting to sync a test file containing safe encoded representations of carriage returns.\n\n## References\n\n- [GitHub Security Advisory GHSA-8c48-q9wj-3w37](https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37)\n- [Official Patch Commit](https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c)\n- [rclone v1.75.0 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n- [NVD CVE-2026-71311 Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-71311)\n- [CVE.org CVE-2026-71311 Record](https://www.cve.org/CVERecord?id=CVE-2026-71311)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71311) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T12:31:36.695543Z"}