GO-2026-6184

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6184

Import Source

https://vuln.go.dev/ID/GO-2026-6184.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6184

Aliases

Published

2026-08-18T16:38:10Z

Modified

2026-08-18T17:24:07.105270667Z

Summary

Path traversal in serve restic in github.com/rclone/rclone

Details

In rclone serve restic, the WithRemote middleware fails to properly sanitize URL paths beginning with "../" or containing ".". Because path.Clean preserves leading parent directory components in relative paths, requests with leading traversal sequences bypass validation. On affected backends (such as WebDAV, FTP, SFTP, HTTP, and memory), an attacker with access to the REST endpoint can read, create, overwrite, or delete objects outside the configured root directory.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6184"
}

References

Credits

- GitHub: CaubiLoureiro

Affected packages

Go / github.com/rclone/rclone

Package

Name: github.com/rclone/rclone; View open source insights on deps.dev
Purl: pkg:golang/github.com/rclone/rclone

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.75.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/rclone/rclone/cmd/serve/restic",
            "symbols": [
                "WithRemote",
                "server.Bind",
                "server.Serve"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6184.json"