{"id":"EUVD-2026-53643","enisaUuid":"f4558ada-5a19-3952-a93b-454784449733","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path syntax, so a local destination using Slash, None, Raw, or on Windows an encoding that preserves backslash can decode a standard-encoded fullwidth dot-dot component or native backslash form into an actual parent-directory component before filepath.Join resolves it outside the configured local root, allowing an attacker-controlled source object to create or overwrite files outside the selected destination directory as the rclone process. This issue is fixed in v1.75.0.","datePublished":"Aug 5, 2026, 8:47:48 PM","dateUpdated":"Aug 6, 2026, 2:40:45 PM","baseScore":6.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L","references":"https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567\nhttps://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e\nhttps://github.com/rclone/rclone/releases/tag/v1.75.0\n","aliases":"CVE-2026-71313\nGHSA-7p4m-qxvv-g567\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"796da0f9-2964-3d56-a947-7a222e9e2f61","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"1.51.0, \u003c 1.75.0"}],"enisaIdVendor":[{"id":"3b5f493f-ce02-3408-90ee-e3d4771939db","vendor":{"name":"rclone"}}],"enisaIdVulnerability":[{"id":"7fd21da4-64ff-36fb-9f83-549063c83ef0","vulnerability":{"id":"CVE-2026-71313","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path syntax, so a local destination using Slash, None, Raw, or on Windows an encoding that preserves backslash can decode a standard-encoded fullwidth dot-dot component or native backslash form into an actual parent-directory component before filepath.Join resolves it outside the configured local root, allowing an attacker-controlled source object to create or overwrite files outside the selected destination directory as the rclone process. This issue is fixed in v1.75.0.","datePublished":"Aug 5, 2026, 8:47:48 PM","dateUpdated":"Aug 6, 2026, 2:40:45 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L","references":"https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567\nhttps://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e\nhttps://github.com/rclone/rclone/releases/tag/v1.75.0\n","enisa_id":"EUVD-2026-53643\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 13, 2026, 7:18:03 AM","vulnerabilityProduct":[{"id":"5a6bacfd-4fee-39a2-a954-14ee9ac3d03a","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"1.51.0, \u003c 1.75.0"}],"vulnerabilityVendor":[{"id":"6da38905-1f1d-385b-a69f-e9ad8d9e3d3b","vendor":{"name":"rclone"}}]}},{"id":"b0e9050a-155d-328d-939f-0ed316c59ac3","vulnerability":{"id":"GHSA-7p4m-qxvv-g567","description":"rclone: Local Encoding Path Traversal","datePublished":"Aug 5, 2026, 8:48:46 PM","dateUpdated":"Aug 5, 2026, 8:48:46 PM","baseScore":0.0,"references":"https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567\nhttps://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e\nhttps://github.com/rclone/rclone\nhttps://github.com/rclone/rclone/releases/tag/v1.75.0\n","enisa_id":"EUVD-2026-53643\n","aliases":"GHSA-7p4m-qxvv-g567\nCVE-2026-71313\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:51:03 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}