rclone: source object names can escape the configured root on upload

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-88046 · CVE overview and exploitation status

EUVD-2026-75589

GHSA-38xv-hf3p-h7mq

BIT-rclone-2026-88046

GO-2026-6457

cve-program · CVE-2026-88046

• https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq
• https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252
• https://github.com/rclone/rclone/releases/tag/v1.75.1

euvd · EUVD-2026-75589

• https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq
• https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252
• https://github.com/rclone/rclone/releases/tag/v1.75.1

nvd · CVE-2026-88046

• https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252
• https://github.com/rclone/rclone/releases/tag/v1.75.1
• https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq

osv · GHSA-38xv-hf3p-h7mq

• https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq
• https://nvd.nist.gov/vuln/detail/CVE-2026-88046
• https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252
• https://github.com/rclone/rclone
• https://github.com/rclone/rclone/releases/tag/v1.75.1

osv · GO-2026-6457

• https://github.com/rclone/rclone/security/advisories/GHSA-38xv-hf3p-h7mq
• https://nvd.nist.gov/vuln/detail/CVE-2026-88046
• https://github.com/rclone/rclone/commit/57842c5ee4e1407eda06a414a36510cce2db4252
• https://github.com/rclone/rclone/releases/tag/v1.75.1

No related changes are available here.