Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: rclone 1.74.4 Clear all filters
TI-2026-55260 CVE-2026-79783 · GHSA-vqwj-943v-724g

rclone before 1.74.4 Privilege Escalation via setuid Metadata

Priority MEDIUM 44

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files.

CVSS 4.0LOW 2.0 Local No auth User interaction EPSS 0.00227 Published 2026-08-25 Partial fix · 1.74.4 CWE-732
TI-2026-55258 CVE-2026-79781 · GHSA-98fh-ch8q-6529

rclone serve s3 Path Traversal via dot-dot object keys

Priority HIGH 70

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00302 Published 2026-08-25 Partial fix · 1.74.4 CWE-22