{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93986", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-19T10:55:49.093Z", "datePublished": "2026-09-19T11:53:37.737Z", "dateUpdated": "2026-09-21T20:46:58.617Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-19T11:53:37.737Z"}, "datePublic": "2026-09-04T00:00:00.000Z", "title": "rclone before 1.75.1 Path Traversal via Directory Listing Names", "descriptions": [{"lang": "en", "value": "rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "rclone", "product": "rclone", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.75.1"}, {"version": "1.75.1", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.75.1"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-3vxh-3pcx-9m8q)"}, {"name": "VulnCheck Advisory: rclone before 1.75.1 Path Traversal via Directory Listing Names", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.1-path-traversal-via-directory-listing-names"}], "credits": [{"lang": "en", "value": "iaohkut", "type": "reporter"}, {"lang": "en", "value": "ncw", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T16:22:58.377796Z", "id": "CVE-2026-93986", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T20:46:58.617Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93986", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T16:22:58.377796Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T16:22:59.409Z"}}], "cna": {"title": "rclone before 1.75.1 Path Traversal via Directory Listing Names", "credits": [{"lang": "en", "type": "reporter", "value": "iaohkut"}, {"lang": "en", "type": "finder", "value": "ncw"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": "0", "lessThan": "1.75.1", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.1", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/rclone/rclone", "defaultStatus": "unaffected"}], "datePublic": "2026-09-04T00:00:00.000Z", "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q", "name": "GitHub Security Advisory (GHSA-3vxh-3pcx-9m8q)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/rclone-before-1.75.1-path-traversal-via-directory-listing-names", "name": "VulnCheck Advisory: rclone before 1.75.1 Path Traversal via Directory Listing Names", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.75.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-19T11:53:37.737Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93986", "state": "PUBLISHED", "dateUpdated": "2026-09-21T20:46:58.617Z", "dateReserved": "2026-09-19T10:55:49.093Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-19T11:53:37.737Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "product": "rclone", "vendor": "rclone", "versions": [{"lessThan": "1.75.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.1", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape."}], "id": "CVE-2026-93986", "lastModified": "2026-09-22T20:25:55.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93986", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-21T16:22:58.377796Z", "version": "2.0.3"}}]}, "published": "2026-09-19T12:16:42.027", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.1-path-traversal-via-directory-listing-names"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: Path traversal vulnerability", "id": "2538671", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538671"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.", "A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to craft special names in server and third-party listing responses. These crafted names, containing directory traversal sequences, could potentially enable writing outside the intended destination directory. However, current downstream protections in the local backend mitigate the risk of actual file escape."], "mitigation": {"lang": "en:us", "value": "Do not point rclone at untrusted shared content on the backends named in this advisory (Google Photos albums, Dropbox or OneDrive shares, PikPak addurl sources, or iCloud Photos with non-default encoding). For VolSync, keep the rclone secret aimed at an S3-compatible bucket that you control. \nNo additional in-product workaround is required for the documented S3/local usage."}, "name": "CVE-2026-93986", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Out of support scope", "package_name": "redhat-user-workloads/volsync-0-12", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-09-19T11:53:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93986\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93986\nhttps://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q\nhttps://www.vulncheck.com/advisories/rclone-before-1.75.1-path-traversal-via-directory-listing-names"], "statement": "This issue is confined to rclone backends that take object names from untrusted third-party listings without restricting them to the listed directory. Independently of backend, rclone's local backend already rejects names that resolve outside the destination root, so a transfer into a local volume cannot escape the mount.", "threat_severity": "Low"}