GO-2026-6457
- Source
- https://pkg.go.dev/vuln/GO-2026-6457
- Import Source
- https://vuln.go.dev/ID/GO-2026-6457.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6457
- Aliases
- Published
- 2026-09-16T16:56:29Z
- Modified
- 2026-09-19T09:25:54Z
- Summary
- rclone: source object names can escape the configured root on upload in github.com/rclone/rclone
- Details
-
rclone: source object names can escape the configured root on upload in github.com/rclone/rclone
- Database specific
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6457" }- References
Affected packages
Go / github.com/rclone/rclone
Package
- Name
- github.com/rclone/rclone
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/rclone/rclone
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.75.1
Ecosystem specific
{
"imports": [
{
"path": "github.com/rclone/rclone/fs/walk",
"symbols": [
"GetAll",
"ListR",
"NewDirTree",
"Walk",
"listR",
"walkRDirTree"
]
},
{
"path": "github.com/rclone/rclone/fs/operations",
"symbols": [
"Cat",
"Check",
"CheckDownload",
"CheckFn",
"CheckSum",
"Count",
"Deduplicate",
"Delete",
"DirMove",
"DirMoveCaseInsensitive",
"HashLister",
"List",
"ListDir",
"ListFn",
"ListJSON",
"ListLong",
"Purge",
"Rmdirs",
"SetTier",
"StatJSON",
"TouchDir"
]
},
{
"path": "github.com/rclone/rclone/fs/list",
"symbols": [
"DirSorted",
"DirSortedFn",
"filterDir"
]
}
]
}