CVE-2026-71312

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0

Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath() function only escapes ASCII apostrophes, failing to account for Unicode characters U+2018, U+2019, U+201A, and U+201B, which PowerShell recognizes as single-quote delimiters. This allows an attacker to use a specially crafted filename to terminate the path literal and execute arbitrary PowerShell statements under the context of the victim SSH account when server-side hashing is triggered.

Recommendations Update to version 1.75.0.