CVE-2026-71309

Name of the Vulnerable Software and Affected Versions rclone versions 1.40.0 through 1.74.0

Description The serve restic command fails to properly reject URL paths starting with ../ in the WithRemote function within cmd/serve/restic/restic.go. This allows a leading parent path to be passed to GET, HEAD, POST, and DELETE handlers for backends such as WebDAV, FTP, HTTP, Memory, and SFTP. An attacker with access to the REST endpoint can read, create, overwrite, or delete objects outside the operator's configured path if the backend credentials have access to parent or sibling objects.

Recommendations Update to version 1.75.0.