GO-2026-6184
Path traversal in serve restic in github.com/rclone/rclone
At a glance
- Published
- Updated
- CVE
- CVE-2026-71309
- Aliases
- BIT-rclone-2026-71309, GHSA-45pq-889g-fcgh
Description
In rclone serve restic, the WithRemote middleware fails to properly sanitize URL paths beginning with "../" or containing ".". Because path.Clean preserves leading parent directory components in relative paths, requests with leading traversal sequences bypass validation. On affected backends (such as WebDAV, FTP, SFTP, HTTP, and memory), an attacker with access to the REST endpoint can read, create, overwrite, or delete objects outside the configured root directory.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/rclone/rclone | introduced 0, fixed 1.75.0 |
References
- https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh ADVISORY
- https://github.com/rclone/rclone/commit/cc5a189f00efe68ed0ddb32d3237b42549a9f264 FIX
- https://github.com/rclone/rclone/releases/tag/v1.75.0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |