No access to your tenant or devices. Every item links to its source. What this means
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "rclone",
"product": "rclone",
"versions": [
{
"version": ">= 1.48.0, < 1.73.5",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON