Hi,
The following vulnerabilities were published for rclone.
CVE-2026-93986[0]:
| rclone before 1.75.1 fails to confine names from server and third-
| party listing responses to the listed directory, allowing path
| traversal sequences in object names. Attackers can craft special
| names containing forward slashes and parent directory references to
| potentially write outside the destination root, though downstream
| protections in the local backend currently block actual file escape.
CVE-2026-93987[1]:
| rclone versions 1.56.0 through 1.75.0 contain a path traversal
| vulnerability in the `rclone serve docker` volume plugin.
| newVolume() in cmd/serve/docker/volume.go computes a volume's
| mountpoint as filepath.Join(drv.root, name) from the attacker-
| supplied `name` field of a Docker VolumeDriver.Create request
| without verifying that the result stays within drv.root (default
| /var/lib/docker-volumes/rclone), and checkMountpoint() then creates
| that directory with file.MkdirAll before mounting. A volume name
| containing enough `..` components (e.g. "../../../../../../etc")
| therefore resolves outside the base directory, allowing anyone able
| to submit a VolumeDriver.Create request to the plugin socket —
| normally the Docker daemon, or a workload that can request named
| volumes in a multi-tenant orchestration setup — to make the
| privileged rclone plugin process create a directory and mount a
| remote filesystem specified in the same request at an arbitrary host
| path, shadowing or disrupting system directories. The advisory notes
| Volume.restoreState() had the same missing validation when reloading
| persisted volume state. Fixed in 1.75.1.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-93986
https://www.cve.org/CVERecord?id=CVE-2026-93986
[1] https://security-tracker.debian.org/tracker/CVE-2026-93987
https://www.cve.org/CVERecord?id=CVE-2026-93987
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore