rclone serve s3 Path Traversal via dot-dot object keys

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-79781 · CVE overview and exploitation status

EUVD-2026-65539

GHSA-98fh-ch8q-6529

GHSA-8v25-v8p6-qf7v

BIT-rclone-2026-79781

GO-2026-6189

cve-program · CVE-2026-79781

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

euvd · EUVD-2026-65539

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

nvd · CVE-2026-79781

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://www.vulncheck.com/advisories/rclone-serve-s3-path-traversal-via-dot-dot-object-keys

osv · GHSA-8v25-v8p6-qf7v

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://github.com/rclone/rclone/commit/83d1e62aa9e0dbd10a5d7eb34c117ae997268cdf
• https://github.com/rclone/rclone/commit/c89b766cf417fddbe7eace40d31262ecb85bfa93
• https://github.com/rclone/rclone
• https://github.com/rclone/rclone/releases/tag/v1.74.4

osv · GO-2026-6189

• https://github.com/rclone/rclone/security/advisories/GHSA-8v25-v8p6-qf7v
• https://github.com/rclone/rclone/commit/83d1e62aa9e0dbd10a5d7eb34c117ae997268cdf
• https://github.com/rclone/rclone/commit/c89b766cf417fddbe7eace40d31262ecb85bfa93
• https://github.com/rclone/rclone/releases/tag/v1.74.4

No related changes are available here.