Dangel165

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.74.4 **Description** The `serve s3` function contains a path traversal flaw. This allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. By sending requests with object keys such as `../root-secret.txt`, an attacker can escape the bucket namespace and access files within the serve root directory. **Recommendations** Update rclone to version 1.74.4 or later.