BIT-rclone-2026-71312
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-71312.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-rclone-2026-71312
- Aliases
- Published
- 2026-08-17T05:53:33.868Z
- Modified
- 2026-08-17T08:10:58.061978126Z
- Summary
- rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
- Details
-
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.
- Database specific
{ "severity": "High", "cpes": [ "cpe:2.3:a:rclone:rclone:*:*:*:*:*:go:*:*" ] }- References
Affected packages
Bitnami / rclone
Package
- Name
- rclone
- Purl
- pkg:bitnami/rclone
Severity
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator