rclone: Local Encoding Path Traversal

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-71313 · CVE overview and exploitation status

EUVD-2026-53643

GHSA-7p4m-qxvv-g567

BIT-rclone-2026-71313

GO-2026-6186

cve-program · CVE-2026-71313

• https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567
• https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e
• https://github.com/rclone/rclone/releases/tag/v1.75.0

euvd · EUVD-2026-53643

• https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567
• https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e
• https://github.com/rclone/rclone/releases/tag/v1.75.0

nvd · CVE-2026-71313

• https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e
• https://github.com/rclone/rclone/releases/tag/v1.75.0
• https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567

osv · GHSA-7p4m-qxvv-g567

• https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567
• https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e
• https://github.com/rclone/rclone
• https://github.com/rclone/rclone/releases/tag/v1.75.0

osv · GO-2026-6186

• https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567
• https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e
• https://github.com/rclone/rclone/releases/tag/v1.75.0

• rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent rem… · Advisory content revised · 15 Nov 2026