VulnSocial

CVE-2026-71309General

LOWCVSS 8.6 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • General: 2 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-08-06: 3Patch / Workaround · 2026-08-06: 1Technical Details · 2026-08-06: 108-06
Signal classification2 categories
General
266.7%
Patch
133.3%
Referenced assets3 URLs
Full discourse3 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - rclone serve restic Path Traversal via WithRemote Middleware (CVE-2026-71309) In rclone `serve restic`, the REST API middleware `WithRemote` performs incomplete path validation and fails to reject URL paths starting with "../". An attacker with access to the REST endpoint can traverse outside the configured backend subdir to read/create/overwrite/delete objects beyond the operator-set root on WebDAV/FTP/HTTP/Memory/SFTP backends. 👉Affected: http://github.com/rclone/rclone 1.40.0-1.74.4 | Upgrade to 1.75.0

    Post summary

    The tweet reveals a high-severity path traversal vulnerability in rclone serve restic and advises users to upgrade to version 1.75.0 for mitigation.

    00030151
    310 followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-71309 rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not c… https://www.cve.org/CVERecord?id=CVE-2026-71309 ----- Traducción: CVE-2026-71309 rcl… http://infoflow.cloud`

    Post summary

    The tweet merely announces the existence of CVE-2026-71309 for rclone, lacking details on exploitation, patches, or a PoC.

    0000058
    97 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-71309 rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not c… https://www.cve.org/CVERecord?id=CVE-2026-71309

    Post summary

    The post merely references CVE-2026-71309 and a link to its record without providing any concrete details, PoC, or mitigation information.

    00000945
    57.9K followersView on X

Explore more

Back to dashboard