DEBIAN-CVE-2026-93986

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-93986

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93986.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-93986

Upstream

CVE-2026-93986

Published

2026-09-19T12:16:42Z

Modified

2026-09-20T10:00:08Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

References

https://security-tracker.debian.org/tracker/CVE-2026-93986

Affected packages

Debian:12 / rclone

Package

Name: rclone
Purl: pkg:deb/debian/rclone?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.60.1+dfsg-2

1.60.1+dfsg-3

1.60.1+dfsg-4

1.65.0+dfsg-1

1.65.0+dfsg-2

1.69.3+dfsg-1

1.69.3+dfsg-2

1.69.3+dfsg-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-93986.json"

Debian:13 / rclone