rclone vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116195 Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path afterHigh 7 · Oct 25, 2026
• CVE-2026-116194 Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state High 7.6 · Oct 25, 2026
• CVE-2026-116192 rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backenHigh 8.2 · Oct 25, 2026
• CVE-2026-116191 Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an High 8.7 · Oct 25, 2026
• CVE-2026-116189 rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearHigh 7.7 · Oct 25, 2026
• CVE-2026-88045 rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 7.5 · Sep 10, 2026
• CVE-2026-88044 rclone is a command-line program to sync files and directories to and from different cloud storage providers.Critical 9.1 · Sep 10, 2026
• CVE-2026-88018 rclone is a command-line program to sync files and directories to and from different cloud storage providers.Critical 9.8 · Sep 10, 2026
• CVE-2026-88017 rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 7.3 · Sep 10, 2026
• CVE-2026-88016 rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 7.1 · Sep 10, 2026
• CVE-2026-79782 rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host.Critical 9.3 · Aug 25, 2026
• CVE-2026-79775 rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which High 7.1 · Aug 25, 2026
• CVE-2026-71312 rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 8 · Aug 5, 2026
• CVE-2026-71309 rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 8.6 · Aug 5, 2026
• CVE-2026-59733 Rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 8.8 · Jul 14, 2026
• CVE-2026-54572 Rclone is a command-line program to sync files and directories to and from different cloud storage providers.High 7.5 · Jul 14, 2026
• CVE-2026-49980 Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Critical 9.8 · Jun 24, 2026
• CVE-2026-41179 Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Critical 9.2 · Apr 22, 2026
• CVE-2026-41176 Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Critical 9.2 · Apr 22, 2026
• CVE-2020-28924 An issue was discovered in Rclone before 1.53.3.High 7.5 · Nov 19, 2020
• CVE-2018-12907 In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's conHigh 7.5 · Jun 27, 2018