PT-2026-80415 · Go · Github.Com/Rclone/Rclone
Published
2026-08-18
·
Updated
2026-08-18
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
PowerShell treats several Unicode smart-quote characters (U+2018, U+2019, U+201A, U+201B) as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename with smart quotes that closes the path literal and injects arbitrary PowerShell commands executed on the SFTP remote as the victim's SSH account.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Github.Com/Rclone/Rclone