{"uuid": "7843cf71-f0d5-4013-bc5b-97588352b9b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71312", "type": "seen", "source": "https://gist.github.com/alon710/67103eb26c8040be3d1015d9a77a7298", "content": "# CVE-2026-71312: CVE-2026-71312: OS Command Injection via Unicode Smart Quote Shell Bypass in rclone SFTP Backend\n\n> **CVSS Score:** 8.0\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71312\n\n## Summary\nAn incomplete sanitization vulnerability exists in rclone's SFTP backend before version 1.75.0 when performing server-side hashing operations on Windows hosts. Due to PowerShell treating Unicode smart quotes as equivalent to ASCII single quotes, malicious file paths can escape command string delimiters and execute arbitrary commands on the remote system.\n\n## TL;DR\nrclone versions prior to 1.75.0 are vulnerable to remote OS command injection when executing server-side hashing on Windows SFTP targets. Attackers can leverage Unicode smart quotes in file paths to bypass single-quote sanitization and execute arbitrary PowerShell commands.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.0\n- **Exploit Status**: PoC / Theoretical\n- **CISA KEV Status**: Not Listed\n- **Impact**: Remote Command Execution (RCE)\n- **Remediation**: Upgrade to v1.75.0 or higher\n\n## Affected Systems\n\n- rclone installations prior to version 1.75.0 interacting with Windows-based SFTP servers using PowerShell\n- **rclone**: < 1.75.0 (Fixed in: `1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.75.0 or later\n- Reconfigure Windows SSH server to use cmd.exe instead of PowerShell as the default shell\n- Implement filename sanitization rules on the SFTP server to block Unicode smart quotes (U+2018 through U+201B)\n\n**Remediation Steps:**\n1. Identify all systems executing rclone commands against Windows SFTP servers.\n2. Update rclone installations to version 1.75.0 or higher.\n3. For systems that cannot be patched immediately, apply server-side mitigations by changing the default SSH shell to cmd.exe.\n\n## References\n\n- [GHSA-2m8m-jhrm-w6j2](https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2)\n- [Fix Commit e122fba](https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88)\n- [rclone v1.75.0 Release](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n- [CVE-2026-71312 Record](https://www.cve.org/CVERecord?id=CVE-2026-71312)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71312) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T10:32:49.808053Z"}