BIT-rclone-2026-59733

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-59733.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-rclone-2026-59733
Aliases
Published
2026-07-19T23:51:46.837Z
Modified
2026-07-20T08:41:26.512176662Z
Summary
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Details

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / rclone

Package

Name
rclone
Purl
pkg:bitnami/rclone

Severity

  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.74.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-59733.json"