CVE-2026-71313

Name of the Vulnerable Software and Affected Versions rclone versions 1.51.0 through 1.74.0

Description The local backend in backend/local/local.go relies on a configurable filename encoder to prevent remote filename data from being interpreted as operating-system path syntax. When a local destination uses Slash, None, Raw, or an encoding on Windows that preserves backslashes, it can decode a standard-encoded fullwidth dot-dot component or native backslash form into a parent-directory component before filepath.Join resolves it. This allows an attacker-controlled source object to create or overwrite files outside the selected destination directory with the permissions of the rclone process.

Recommendations Update rclone to version 1.75.0.