CVE-2026-59733

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4

Description When using the serve restic --private-repos command, the software enforces authorization based on the routed user path segment but constructs the backend object key using the raw, uncleaned URL path. This allows an authenticated user to employ path traversal by including .. in a request, such as //..//config, to read, overwrite, or delete private repositories belonging to other users on backends that clean path components.

Recommendations Update to version 1.74.4.