Vulnerabilities

Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts.

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the de…

Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter.

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests.

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing n…

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component.

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects.

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block.

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit.

Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs.

rclone is a command-line program to sync files and directories to and from different cloud storage providers.

rclone is a command-line program to sync files and directories to and from different cloud storage providers.

rclone is a command-line program to sync files and directories to and from different cloud storage providers.

rclone is a command-line program to sync files and directories to and from different cloud storage providers.

rclone is a command-line program to sync files and directories to and from different cloud storage providers.

rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

An issue was discovered in Rclone before 1.53.3.

In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's content to Google, because there is no validation of a URL fiel…