CyberRota Analysis
AI-GeneratedRclone versions prior to 1.75.1 are vulnerable to path traversal due to insufficient confinement of object names from server and third-party responses, allowing attackers to exploit crafted names with forward slashes and parent directory references. While local backend protections currently prevent actual file escape, the potential for unauthorized file manipulation exists. Organizations using Rclone should prioritize upgrading to mitigate this risk, especially those handling sensitive data or operating in untrusted environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.