{"vulnerability": "cve-2026-71313", "sightings": [{"uuid": "1a3a572c-5003-426d-8113-193b69d34d11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71313", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567", "content": "", "creation_timestamp": "2026-08-05T22:35:14.248053Z"}, {"uuid": "8272bfeb-eec9-4d5f-9744-92a4b7bb54ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71313", "type": "seen", "source": "https://gist.github.com/alon710/49b7a81d033518d9857d9b26baae89fd", "content": "# CVE-2026-71313: CVE-2026-71313: Local Directory Traversal in rclone via Unsafe Encoding Configurations\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71313\n\n## Summary\nA local encoding path traversal vulnerability exists in rclone versions from v1.51.0 up to v1.75.0. When non-default local encoding parameters (such as Slash, None, or Raw) are specified, rclone's standard decoder maps safely encoded fullwidth dot-dot characters back into native directory traversal components. Since the local backend historically lacked a post-resolution path containment check, these relative segments resolved outside the designated synchronization root, allowing arbitrary file creation and modification on the host system.\n\n## TL;DR\nIn rclone versions v1.51.0 to v1.74.x, configured local target encodings that omit dot-protection allow malicious remote filenames to escape the designated sync root and manipulate arbitrary host files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.9 (Medium)\n- **Exploit Status**: PoC-level\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- rclone command-line utility (v1.51.0 through v1.74.x)\n- **rclone**: >= 1.51.0, < 1.75.0 (Fixed in: `v1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone to v1.75.0 or later to enable native lexical containment checks.\n- Do not configure the local backend with custom local encoding options (such as Slash, None, or Raw) that remove standard Dot safety checks.\n- Restrict host execution context using containerization, SELinux, or AppArmor to prevent system-wide impacts from potential directory traversals.\n\n**Remediation Steps:**\n1. Scan execution systems to identify installed rclone versions between v1.51.0 and v1.74.x.\n2. Apply the patch by updating to v1.75.0 or later using official vendor sources.\n3. Audit automated configurations or scripts for occurrences of '--local-encoding Slash', '--local-encoding None', or '--local-encoding Raw' parameters.\n\n## References\n\n- [https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567](https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567)\n- [https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e](https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e)\n- [https://github.com/rclone/rclone/releases/tag/v1.75.0](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71313) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T06:31:10.764819Z"}]}