Iaohkut

**Name of the Vulnerable Software and Affected Versions** rclone versions prior to 1.75.1 **Description** The software fails to confine names from server and third-party listing responses to the listed directory. This allows path traversal sequences in object names, where attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root. However, downstream protections in the local backend currently block actual file escape. **Recommendations** Update rclone to version 1.75.1 or later.

**Name of the Vulnerable Software and Affected Versions** rclone versions 1.56.0 through 1.75.0 **Description** A path traversal issue exists in the `rclone serve docker` volume plugin. The `newVolume()` function in `cmd/serve/docker/volume.go` calculates a volume mountpoint using the `name` variable from a Docker VolumeDriver.Create request without verifying that the resulting path remains within the intended root directory. Subsequently, the `checkMountpoint()` function creates this directory using `file.MkdirAll` before mounting. An attacker providing a `name` containing path traversal sequences (e.g., `../../../../../../etc`) can force the privileged rclone process to create a directory and mount a remote filesystem at an arbitrary host path, potentially shadowing or disrupting system directories. Additionally, the `Volume.restoreState()` function lacks similar validation when reloading persisted volume state. **Recommendations** Update to version 1.75.1.

**Name of the Vulnerable Software and Affected Versions** Flysystem versions prior to 3.35.3 **Description** In the `WhitespacePathNormalizer` class within `src/WhitespacePathNormalizer.php`, the `normalizePath()` function uses `preg match()` with the `u` modifier to detect control characters. When a path contains malformed UTF-8 characters, `preg match()` returns `false` instead of `0`. Because the code uses a truthy check, it fails to distinguish between a non-match and an engine error, allowing paths with both malformed UTF-8 and control characters to bypass the `CorruptedPathDetected::forPath()` exception. This allows `Filesystem::write()` to store files with malicious names. Subsequently, `Filesystem::listContents()` can return raw ANSI escape sequences, which may lead to hidden or spoofed terminal file listings when viewed by an administrator. **Recommendations** Update Flysystem to version 3.35.3 or later. As a temporary mitigation, restrict the use of the `normalizePath()` function or validate that input paths contain only valid UTF-8 characters before they are processed by the library.