{"vulnerability": "CVE-2026-59733", "sightings": [{"uuid": "b6456d56-80e2-43b9-92b1-7b6ccdeba00a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59733", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg", "content": "", "creation_timestamp": "2026-08-05T22:35:18.603178Z"}, {"uuid": "a0691132-d055-421e-acce-eed26bee84b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://gist.github.com/alon710/7ddcb99c6c6e60ab01c10a8cda75b225", "content": "# CVE-2026-59733: CVE-2026-59733: Path Traversal and Authorization Bypass in Rclone serve restic\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59733\n\n## Summary\nA critical path traversal and authorization bypass vulnerability exists in the rclone serve restic command when multi-user isolation is enabled using the --private-repos flag. Due to a middleware desynchronization flaw, authenticated users can access, modify, or delete backup repositories belonging to other tenants.\n\n## TL;DR\nA middleware path-desynchronization defect in rclone serve restic allows authenticated users to bypass repository isolation and access other tenants' backups using path traversal sequences.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-639\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1**: 8.8 (High)\n- **EPSS Score**: 0.00422\n- **Impact**: Complete compromise of repository confidentiality, integrity, and availability\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Rclone (serve restic subcommand)\n- **rclone**: < 1.74.4 (Fixed in: `1.74.4`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.74.4 or higher\n- Run separate single-tenant daemons instead of using --private-repos flag\n- Deploy an upstream WAF or reverse proxy to block path traversal sequences\n\n**Remediation Steps:**\n1. Identify all active rclone instances executing 'serve restic' with the '--private-repos' argument\n2. Download the latest stable release (v1.74.4 or later) from official sources\n3. Replace the existing rclone binary with the updated version\n4. Restart the service and monitor access logs for HTTP 400 responses to verify block mechanisms\n\n## References\n\n- [GHSA-fqj9-69pf-6pjg: Path traversal and authorization bypass in rclone serve restic](https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg)\n- [Rclone Fix Commit](https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d)\n- [Rclone v1.74.4 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n- [NVD - CVE-2026-59733](https://nvd.nist.gov/vuln/detail/CVE-2026-59733)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59733) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T09:31:29.269193Z"}, {"uuid": "e92973a9-218e-44ad-9b0e-99f94566ce04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqncqefi572b", "content": "\ud83d\udfe0 CVE-2026-59733 - High (8.8)\n\nRclone is a command-line program to sync files and directories to and from different cloud storag...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-59733/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-14T23:00:35.453472Z"}, {"uuid": "685233d0-87a5-48b5-9fe6-8cf42a69e1b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqnhy5ivbc2q", "content": "CVE-2026-59733 - rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories\nCVE ID : CVE-2026-59733\n \n Published : July 14, 2026, 10:17 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Descri...", "creation_timestamp": "2026-07-15T00:34:24.873870Z"}, {"uuid": "c1101b43-88dd-481b-ab9a-167da26399f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqvkc6bevg2y", "content": "\ud83d\udccc CVE-2026-59733 - Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --p... https://www.cyberhub.blog/cves/CVE-2026-59733", "creation_timestamp": "2026-07-18T05:37:06.976559Z"}, {"uuid": "75986dfa-aa4e-43e6-a1cf-7e79a0ea4ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk2ozse62i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59733 \u0432 rclone: \u043e\u0431\u0445\u043e\u0434 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0443\u0442\u044c URL\n\n\n\nhttps://kripta.biz/posts/7981FCA8-AC9C-4451-B498-922037D87BC6", "creation_timestamp": "2026-07-27T09:04:09.647333Z"}, {"uuid": "b2d7627c-23e7-4888-bd54-2127239120ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmk2wojvo25", "content": "\u05e4\u05d2\u05d9\u05e2\u05d4 \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1\u05e8\u05e7\u05dc\u05d0\u05d5\u05df: CVE-2026-59733 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d2\u05d9\u05e9\u05d4 \u05dc\u05d0 \u05de\u05d5\u05e8\u05e9\u05ea \u05dc\u05de\u05d0\u05d2\u05e8\u05d9 \u05e4\u05e8\u05d8\u05d9\u05d9\u05dd\n\n\n\nhttps://khesef.xyz/posts/C242D62F-2C46-4575-BC3A-AC59F9C4897A", "creation_timestamp": "2026-07-27T09:04:17.847253Z"}]}