What’s Vulnerable › Vulnerabilities

CVE-2026-93986: rclone before 1.75.1 Path Traversal via Directory Listing Names

• Severity: low (CVSS 3.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-19 · updated 2026-09-22
• Weakness: CWE-22

Description

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

Affected products

• rclone: before 1.75.1 — fixed in 1.75.1

How to fix

Upgrade to a fixed version: rclone 1.75.1. Check the vendor advisory for mitigations.

References

• https://github.com/rclone/rclone/security/advisories/GHSA-3vxh-3pcx-9m8q
• https://www.vulncheck.com/advisories/rclone-before-1.75.1-path-traversal-via-directory-listing-names

Get alerted when CVE-2026-93986 or the next vulnerability affects your stack