PT-2026-123032

CVE-2026-116191

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Rclone versions prior to 1.75.2

Description A path traversal issue exists in the serve webdav functionality. Unauthenticated attackers can write files outside the served root directory by sending an unvalidated .. path component. This is achieved by sending an MKCOL /.. request to plant a Virtual File System (VFS) node, followed by PUT, MOVE, COPY, or MKCOL requests to create, overwrite, or delete files belonging to other tenants.

Recommendations Update Rclone to version 1.75.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-116191