rclone serve s3 Path Traversal via dot-dot object keys

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-79781 · Microsoft / collected KEV context

EUVD-2026-65539

GHSA-98fh-ch8q-6529

GHSA-8v25-v8p6-qf7v

BIT-rclone-2026-79781

GO-2026-6189

cve-program · CVE-2026-79781

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

euvd · EUVD-2026-65539

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

nvd · CVE-2026-79781

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

osv · GHSA-8v25-v8p6-qf7v

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://github.com/rclone/rclone/commit/83d1e62aa9e0dbd10a5d7eb34c117ae997268cdf
• https://github.com/rclone/rclone/commit/c89b766cf417fddbe7eace40d31262ecb85bfa93
• https://github.com/rclone/rclone
• https://github.com/rclone/rclone/releases/tag/v1.74.4

osv · GO-2026-6189

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://github.com/rclone/rclone/commit/83d1e62aa9e0dbd10a5d7eb34c117ae997268cdf
• https://github.com/rclone/rclone/commit/c89b766cf417fddbe7eace40d31262ecb85bfa93
• https://github.com/rclone/rclone/releases/tag/v1.74.4

No related operational record is retained in the current change model.