https://vulnerability.circl.lu/sightings/feed 2026-08-12T06:58:19.966006+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/82e44e19-1d14-492d-bda0-049df7b94948/export 2026-08-12T06:58:19.977997+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "82e44e19-1d14-492d-bda0-049df7b94948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8V25-V8P6-QF7V", "type": "seen", "source": "https://gist.github.com/alon710/24bef11b86322cc9770e86fa941513f4", "content": "# GHSA-8V25-V8P6-QF7V: GHSA-8V25-V8P6-QF7V: Path Traversal in rclone S3 API Gateway Emulation\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/GHSA-8V25-V8P6-QF7V\n\n## Summary\nA path traversal vulnerability exists in the S3 emulation layer of rclone when executing the 'serve s3' subcommand. Because the application maps client-supplied S3 object keys containing relative directory sequences to file paths without proper boundary checks, an attacker can escape the logical containment of a target bucket. This enables unauthorized reading, writing, and deletion of files at the root level of the served storage directory.\n\n## TL;DR\nThe rclone 'serve s3' subcommand suffers from a path traversal vulnerability because it relies on standard Go path joining which normalizes relative sequences (..), allowing clients to access the root directory of the served storage.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)\n- **Attack Vector**: Network (AV:N)\n- **Required Privileges**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **CVSS v3.1 Severity Score**: 8.6 (High)\n- **Exploit Status**: PoC / Unit-Test verified\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- rclone S3 gateway service (rclone serve s3 subcommand) on all operational environments\n- **rclone**: < v1.74.4 (Fixed in: `v1.74.4`)\n\n## Mitigation\n\n- Upgrade the rclone application to version v1.74.4 or newer immediately.\n- Deploy a reverse proxy or WAF rule to block incoming request paths containing '..' or URL-encoded path traversal sequences.\n- Run the rclone process under a restricted, rootless user account and restrict file system permissions to only the designated S3 directory root.\n- Implement a chroot jail or container isolation to limit rclone's system visibility.\n\n**Remediation Steps:**\n1. Check the running rclone version using command: rclone version\n2. If version is below v1.74.4, download the latest package from the official source or run system package managers to update.\n3. Apply the updated rclone executable and restart the 'serve s3' daemon process.\n4. If instant upgrade is unavailable, configure Nginx, HAProxy, or AWS WAF to drop requests containing pattern '..'.\n\n## References\n\n- [GitHub Security Advisory GHSA-8V25-V8P6-QF7V](https://github.com/advisories/GHSA-8V25-V8P6-QF7V)\n- [rclone Source Code Repository](https://github.com/rclone/rclone)\n- [rclone Release v1.74.4](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8V25-V8P6-QF7V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T14:32:29.877977Z"} 2026-08-06T14:32:29.877977+00:00