CVE-2026-88046

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1

Description rclone core fails to reject parent-directory segments (..) in source Object.Remote() values before they are passed to destination backends. This occurs when a source is a flat-keyspace object store populated with native, non-rclone tooling that allows raw .. key segments. Affected destination backends include b2, swift, qingstor, oracleobjectstorage, internetarchive, smb, storj, sftp, webdav, ftp, filelu, shade, and sia.

These backends use path.Join(root, remote) before the EncodeDot function can neutralize the segment, allowing a copy or upload operation to escape the configured root. This can result in files being written to another bucket, share, or path reachable by the victim's credentials. For sftp and smb, this may allow access to other filesystem locations or shares under the same login authority.

Recommendations Update rclone to version 1.75.1 or later.