VulnSocial

CVE-2026-59733Disclosure(rclone / rclone)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch rclone rclone systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.

rclone CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-22CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rclone

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-15); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
rclone
Products
rclone

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-15: 1Mentions · 2026-07-17: 1Patch / Workaround · 2026-07-17: 1Technical Details · 2026-07-15: 1Technical Details · 2026-07-17: 107-1507-17
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-151
Disclosure1
2026-07-171
Patch1
Full discourse2 posts
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-59733 (CVSS 8.8) - Path traversal in Rclone <1.74.4 allows authenticated users to access/modify other users' private repos via ../ sequences. Upgrade to 1.74.4 immediately. #CVE #PatchNow #ThreatIntel https://t.co/ujGew4hcT5

    Post summary

    An urgent advisory alerts that CVE‑2026‑59733, a path traversal vulnerability in Rclone (CVSS 8.8), allows authenticated users to access other users’ private repositories, and users should upgrade to 1.74.4 immediately.

    0000037
    80 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-59733 Path Traversal in Rclone Serve Restic Prior to Version 1.74.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-59733 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    A new path‑traversal vulnerability (CVE‑2026‑59733) affecting Rclone Serve Restic prior to v1.74.4 has been disclosed via a vulnerability alert link, with no PoC, exploit, or patch details provided.

    00000120
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apprclonerclone---

Explore more

Back to dashboardrclone CVEsrclone vulnerabilities