VulnSocial

CVE-2026-93986Patch

LOWCVSS 2.3 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-19); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-19: 1Mentions · 2026-10-27: 1Patch / Workaround · 2026-09-19: 1Patch / Workaround · 2026-10-27: 1Technical Details · 2026-09-19: 1Technical Details · 2026-10-27: 109-1910-27
Signal classification1 categories
Patch
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Patch

    CVE-2026-93986 rclone path traversal, CVSS 3.1. Crafted object names could write outside the destination root, though local backend checks currently block escape. Patch under review, so track it and update when released. #CVE #infosec https://www.valtersit.com/cve/CVE-2026-93986 #rclone #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text announces CVE-2026-93986 affecting rclone with technical details and advises tracking and updating once a patch is released.

    0000036
    1.1K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-93986 rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. … https://www.cve.org/CVERecord?id=CVE-2026-93986

    Post summary

    The post describes CVE-2026-93986, a path traversal vulnerability in rclone versions prior to 1.75.1, and notes that upgrading to rclone 1.75.1 resolves the issue.

    00000910
    58.1K followersView on X

Explore more

Back to dashboard