CVE-2026-93986

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1

Description The software fails to confine names from server and third-party listing responses to the listed directory. This allows path traversal sequences in object names, where attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root. However, downstream protections in the local backend currently block actual file escape.

Recommendations Update rclone to version 1.75.1 or later.