High severity8.8OSV Advisory· Published Jul 14, 2026· Updated Jul 29, 2026
CVE-2026-59733
CVE-2026-59733
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/rclone/rcloneGo | < 1.74.4 | 1.74.4 |
Affected products
9- osv-coords6 versionspkg:apk/chainguard/telegraf-1.38pkg:apk/chainguard/telegraf-1.39pkg:apk/wolfi/telegraf-1.38pkg:bitnami/rclonepkg:rpm/opensuse/rclone&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rclone&distro=openSUSE%20Tumbleweed
< 1.38.4-r19+ 5 more
- (no CPE)range: < 1.38.4-r19
- (no CPE)range: < 1.39.2-r3
- (no CPE)range: < 1.38.4-r19
- (no CPE)range: < 1.74.4
- (no CPE)range: < 1.74.4-bp160.1.1
- (no CPE)range: < 1.74.4-1.1
Patches
Vulnerability mechanics
References
6- github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2dnvdPatchWEB
- github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139nvdPatchWEB
- github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjgnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-fqj9-69pf-6pjgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59733ghsaADVISORY
- github.com/rclone/rclone/releases/tag/v1.74.4nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.