{"id":"GHSA-2m8m-jhrm-w6j2","revision":null,"records":[{"revision":"a7b94f3ddb0f40a0aac4ec017253934b","observedAt":"2026-11-03T23:57:16.858+00:00","statement":{"source":"cve-program","id":"CVE-2026-71312","aliases":[],"title":"rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.","state":0,"publishedAt":"2026-08-05T20:37:49.029+00:00","modifiedAt":"2026-11-03T22:13:31.629+00:00","affected":[{"ecosystem":"Vendor product","name":"rclone","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rclone\",\n                    \"product\": \"rclone\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.75.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8,"severity":"HIGH"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2","https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88","https://github.com/rclone/rclone/releases/tag/v1.75.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-71312","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-71312","identifiers":["CVE-2026-71312"]},"retained":false,"historicalAffected":[]},{"revision":"34de5030c6a64ad29e24e8cd6f3eb749","observedAt":"2026-11-13T17:02:12.601+00:00","statement":{"source":"euvd","id":"EUVD-2026-53619","aliases":["CVE-2026-71312","GHSA-2m8m-jhrm-w6j2"],"title":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeSh…","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8,"severity":null}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2","https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88","https://github.com/rclone/rclone/releases/tag/v1.75.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53619","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 5, 2026, 8:37:49 PM","dateUpdated":"Nov 3, 2026, 10:13:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-53619","identifiers":["EUVD-2026-53619","CVE-2026-71312","GHSA-2m8m-jhrm-w6j2"]},"retained":false,"historicalAffected":[]},{"revision":"14e29a474db941268f53729bde47e27d","observedAt":"2026-11-04T19:04:27.006+00:00","statement":{"source":"nvd","id":"CVE-2026-71312","aliases":[],"title":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeSh…","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.","state":0,"publishedAt":"2026-08-05T21:16:58.867+00:00","modifiedAt":"2026-11-03T23:17:53.807+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8,"severity":"HIGH"}],"references":["https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88","https://github.com/rclone/rclone/releases/tag/v1.75.0","https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71312","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-78"],"productCriteria":[],"sourceDates":{"published":"2026-08-05T21:16:58.867","lastModified":"2026-11-03T23:17:53.807"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-71312","identifiers":["CVE-2026-71312"]},"retained":false,"historicalAffected":[]},{"revision":"8a81e5f07a744f3baf92269bedd48a9a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2m8m-jhrm-w6j2","aliases":["BIT-rclone-2026-71312","CVE-2026-71312","GO-2026-6182"],"title":"rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution","description":"## 1. Summary\n\nrclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim's SSH account.\n\n## 2. Affected Assets & Attack Surface\n\n- Audited commit: `a0c09f1381ae93e2a9a33c529d170186c61ad058`\n- Backend: `backend/sftp`\n- Relevant code:\n  - `backend/sftp/sftp.go:1802-1812` — PowerShell hash commands\n  - `backend/sftp/sftp.go:1663-1699` — `Fs.run`\n  - `backend/sftp/sftp.go:1988-2067` — `Object.Hash`\n  - `backend/sftp/sftp.go:2071-2090` — `quoteOrEscapeShellPath`\n- Exposed input: remote filename controlled by an SFTP collaborator, upstream storage source, or other party able to create or rename files.\n- Required execution context: PowerShell as the SSH command shell, SSH exec enabled, and server-side hashing invoked.\n\n## 3. Technical Root Cause Analysis\n\nFor PowerShell, `quoteOrEscapeShellPath` wraps a path in ASCII apostrophes and doubles only `U+0027`:\n\n```go\nreturn \"'\" + strings.ReplaceAll(shellPath, \"'\", \"''\") + \"'\", nil\n```\n\nWindows PowerShell also treats `U+2018`, `U+2019`, `U+201A`, and `U+201B` as single-quote delimiters. Those characters pass through the rclone encoder and can close the quoted path. The completed string is sent as shell source through an SSH exec request.\n\nThe security boundary fails because shell syntax is constructed by string concatenation rather than passing data through a non-code channel.\n\n## 4. Proof-of-Concept & Evidence\n\n- Each of the four Unicode smart quotes was passed through the production quoting function and used to terminate the path literal.\n- A harmless injected `Set-Content` statement created a marker file.\n- The stronger test invoked the exact production `Object.Hash` path and MD5 PowerShell command against a fake SSH session backed by local PowerShell.\n- A valid prefix file allowed `Get-FileHash` to complete; the appended statement then executed.\n- The filename used only characters permitted by Windows filesystems and did not depend on slash, colon, pipe, or ASCII apostrophe.\n- The focused test passed normally and under Go's race detector.\n\nReproduction outline:\n\n1. Configure an SFTP remote whose command shell is PowerShell.\n2. Enable or autodetect the PowerShell hash command.\n3. Place a file whose name contains a smart quote followed by a harmless marker-writing statement and PowerShell comment syntax.\n4. Trigger an rclone operation that calculates the remote hash.\n5. Observe the marker created with the SSH account's permissions.\n\n## 5. Impact Assessment\n\nSuccessful exploitation provides arbitrary command execution as the victim's SSH account. This can permit file theft, modification, deletion, credential access, persistence, and lateral movement allowed by that account.\n\nThe attacker needs filename-control capability but does not need the victim's SSH credentials or an interactive shell. The rclone user's hash operation supplies the execution step.","state":0,"publishedAt":"2026-08-05T20:37:56+00:00","modifiedAt":"2026-09-10T03:50:53.2070116+00:00","affected":[{"ecosystem":"Go","name":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.75.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2","https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88","https://github.com/rclone/rclone","https://github.com/rclone/rclone/releases/tag/v1.75.0"],"sourceUrl":"https://github.com/advisories/GHSA-2m8m-jhrm-w6j2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2m8m-jhrm-w6j2","identifiers":["GHSA-2m8m-jhrm-w6j2","BIT-rclone-2026-71312","CVE-2026-71312","GO-2026-6182"]},"retained":false,"historicalAffected":[]},{"revision":"040fc77c9f8d4097a353d251a094ec64","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6182","aliases":["BIT-rclone-2026-71312","CVE-2026-71312","GHSA-2m8m-jhrm-w6j2"],"title":"Command execution via PowerShell smart quotes in github.com/rclone/rclone","description":"PowerShell treats several Unicode smart-quote characters (U+2018, U+2019, U+201A, U+201B) as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename with smart quotes that closes the path literal and injects arbitrary PowerShell commands executed on the SFTP remote as the victim's SSH account.","state":0,"publishedAt":"2026-08-18T16:38:10+00:00","modifiedAt":"2026-08-18T17:24:11.1089958+00:00","affected":[{"ecosystem":"Go","name":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.75.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-2m8m-jhrm-w6j2","https://github.com/rclone/rclone/commit/e122fba1a57641b63a580aa26c026903a84e2e88","https://github.com/rclone/rclone/releases/tag/v1.75.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6182","license":"OSV · upstream source license applies","key":"osv:GO-2026-6182","identifiers":["GO-2026-6182","BIT-rclone-2026-71312","CVE-2026-71312","GHSA-2m8m-jhrm-w6j2"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T10:02:17.3763497+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T10:02:17.3763497+00:00","lastSuccessAt":"2026-11-15T10:02:17.6058686+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:17.6058701+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-3113592d787b958ba87cf6300a2f439f8836169d49c36cdd65ca959c60a1acfe","complete":true,"records":425784,"lastAttemptAt":"2026-11-15T10:02:16.903149+00:00","lastSuccessAt":"2026-11-15T10:02:16.8893294+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:16.903149+00:00","snapshotPublishedAt":"2026-11-15T09:28:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ab7e83ec40d841f68d6d65c6dcc2aa85","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T10:12:45.3805188+00:00","lastSuccessAt":"2026-11-15T10:12:45.374+00:00","error":"158 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:12:45.374+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13573,"expectedIdentifiers":13874,"failedIdentifiers":158},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T10:02:17.3763497+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T10:02:17.3763497+00:00","lastSuccessAt":"2026-11-15T10:02:17.760821+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:17.7608224+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T10:02:36.0431422+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T10:02:17.2383659+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:17.2383659+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T10:02:16.9649371+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:16.9649371+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T10:02:17.2553329+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:17.2553329+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-878f718ccd076f540460423958c8e379b139b997b45858275573ecc4d702fe9a","complete":true,"records":232474,"lastAttemptAt":"2026-11-15T10:02:17.1321415+00:00","lastSuccessAt":"2026-11-15T05:33:06.8241102+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:17.1321415+00:00","snapshotPublishedAt":"2026-11-15T04:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}