{"uuid": "a0691132-d055-421e-acce-eed26bee84b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://gist.github.com/alon710/7ddcb99c6c6e60ab01c10a8cda75b225", "content": "# CVE-2026-59733: CVE-2026-59733: Path Traversal and Authorization Bypass in Rclone serve restic\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59733\n\n## Summary\nA critical path traversal and authorization bypass vulnerability exists in the rclone serve restic command when multi-user isolation is enabled using the --private-repos flag. Due to a middleware desynchronization flaw, authenticated users can access, modify, or delete backup repositories belonging to other tenants.\n\n## TL;DR\nA middleware path-desynchronization defect in rclone serve restic allows authenticated users to bypass repository isolation and access other tenants' backups using path traversal sequences.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-639\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1**: 8.8 (High)\n- **EPSS Score**: 0.00422\n- **Impact**: Complete compromise of repository confidentiality, integrity, and availability\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Rclone (serve restic subcommand)\n- **rclone**: < 1.74.4 (Fixed in: `1.74.4`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.74.4 or higher\n- Run separate single-tenant daemons instead of using --private-repos flag\n- Deploy an upstream WAF or reverse proxy to block path traversal sequences\n\n**Remediation Steps:**\n1. Identify all active rclone instances executing 'serve restic' with the '--private-repos' argument\n2. Download the latest stable release (v1.74.4 or later) from official sources\n3. Replace the existing rclone binary with the updated version\n4. Restart the service and monitor access logs for HTTP 400 responses to verify block mechanisms\n\n## References\n\n- [GHSA-fqj9-69pf-6pjg: Path traversal and authorization bypass in rclone serve restic](https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg)\n- [Rclone Fix Commit](https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d)\n- [Rclone v1.74.4 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n- [NVD - CVE-2026-59733](https://nvd.nist.gov/vuln/detail/CVE-2026-59733)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59733) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T09:31:29.269193Z"}