https://vulnerability.circl.lu/sightings/feed 2026-09-16T07:12:26.770550+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/09cc461c-2e9b-46f7-a7d9-1e80c7c6d37d/export 2026-09-16T07:12:26.799069+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "09cc461c-2e9b-46f7-a7d9-1e80c7c6d37d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88046", "type": "seen", "source": "https://gist.github.com/alon710/31db43b5866ca861d12e36661fc88337", "content": "# CVE-2026-88046: CVE-2026-88046: Directory Traversal and Root Confinement Escape in rclone Core Engine\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88046\n\n## Summary\nCVE-2026-88046 (also tracked via GHSA-38xv-hf3p-h7mq) is a directory traversal and root confinement escape vulnerability residing in the core listing and transfer logic of rclone. Prior to version 1.75.1, raw relative parent-directory sequences returned by flat-keyspace source backends are trusted and processed without proper sanitization, enabling writes outside the designated target root or bucket.\n\n## TL;DR\nA path traversal vulnerability in rclone versions prior to 1.75.1 allows attackers with control over a source flat-keyspace storage provider to write arbitrary files to unauthorized directories on target backends.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network / User Interaction Required\n- **CVSS v3.1**: 5.3 (Medium)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- rclone\n- **rclone**: < 1.75.1 (Fixed in: `1.75.1`)\n\n## Mitigation\n\n- Upgrade rclone client binaries to version 1.75.1 or newer.\n- Audit existing cloud storage namespaces for relative parent-directory sequences (..).\n- Apply principle of least privilege to service accounts used during rclone executions.\n\n**Remediation Steps:**\n1. Identify all production environments using rclone via 'rclone version'.\n2. Deploy rclone 1.75.1 or higher to all running container environments, cron servers, and user workstations.\n3. Audit automated workflows targeting external/untrusted data sources and establish strict validation boundaries.\n\n## References\n\n- [rclone Fix Commit 57842c5ee4e1407eda06a414a36510cce2db4252](https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252)\n- [rclone Release v1.75.1](https://github.com/rclone/rclone/releases/tag/v1.75.1)\n- [GitHub Security Advisory GHSA-38xv-hf3p-h7mq](https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq)\n- [NVD CVE-2026-88046](https://nvd.nist.gov/vuln/detail/CVE-2026-88046)\n- [CVE.org CVE-2026-88046](https://www.cve.org/CVERecord?id=CVE-2026-88046)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88046) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T11:32:31.522761Z"} 2026-09-11T11:32:31.522761+00:00 https://vulnerability.circl.lu/sighting/0b16c893-9e83-49da-a6f0-444f18e5ac05/export 2026-09-16T07:12:26.806568+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "0b16c893-9e83-49da-a6f0-444f18e5ac05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88046", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq", "content": "", "creation_timestamp": "2026-09-11T00:35:25.412242Z"} 2026-09-11T00:35:25.412242+00:00 https://vulnerability.circl.lu/sighting/0fd1e8bf-852d-4908-9497-a040f27445e8/export 2026-09-16T07:12:26.808102+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0fd1e8bf-852d-4908-9497-a040f27445e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88046", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/f3syrtwtj43lj", "content": "CVE-2026-88046 - rclone: source object names can escape the configured root on upload\nCVE ID : CVE-2026-88046\n \n Published : Sept. 10, 2026, 5:17 p.m. | 15\u00a0minutes ago\n \n Description : rclone is a command-line program to sync files and directories to and from different cloud s...", "creation_timestamp": "2026-09-10T17:57:56.353199Z"} 2026-09-10T17:57:56.353199+00:00