rclone Package Path Traversal Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- < 1.75.1
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the rclone package that may allow source object names to escape the configured root on upload. This affects multiple backends.
What happened
An early warning has been issued regarding a vulnerability in the rclone package. The issue reportedly allows source object names to escape the configured root on upload due to improper handling of '..' segments. This affects multiple backends and could potentially lead to unauthorized access. The vulnerability is tracked under GHSA-38xv-hf3p-h7mq and was first flagged on 2026-09-10T22:45:36+00:00.
The rclone package, specifically versions affected prior to 1.75.1, is under investigation for this path traversal vulnerability. The issue has not been exploited in the wild as of the latest reports. Users of affected versions should assess their exposure by reviewing their use of rclone backends and considering the potential impact of unauthorized access.
What to do about it
- Monitor for updates from the rclone maintainers that address the path traversal vulnerability.
- Consider restricting the use of affected rclone backends until a fix is available.
- Review your current rclone configurations and backend usage to assess potential exposure.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using rclone versions prior to 1.75.1.
What should I do right now?
Monitor for updates from the rclone maintainers and consider restricting the use of affected backends until a fix is available.
Has a fix been released?
No official fix has been published yet. Continue to monitor the sources for updates.
Which rclone versions are affected?
Versions affected are prior to 1.75.1.