CVE Alert: CVE-2026-116191 – rclone

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated ‘..’ path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

**Risk verdict:** High priority for internet-reachable WebDAV services; current exploitation urgency cannot be confirmed because KEV, SSVC and PoC status are not provided.

**Why this matters:** A remote attacker may alter files outside the intended served directory, including data shared between tenants. Likely goals include tampering with user content, planting malicious files or disrupting workflows; the stated impact is integrity-focused, not direct data disclosure or service outage.

**Most likely attack path:** The service must be reachable over the network, but the attack needs no account, special conditions or user action. Crafted WebDAV requests can trigger the flaw; scope is unchanged, so do not infer host-level compromise, although shared storage boundaries may expose other tenants’ files.

**Who is most exposed:** Prioritise internet-facing WebDAV endpoints and deployments serving shared or multi-tenant storage. Internal services remain at risk where untrusted users or workloads can reach them.

Review WebDAV access logs for `MKCOL` requests targeting parent paths or unusual traversal components.

Correlate suspicious `MKCOL` activity with subsequent `PUT`, `MOVE` or `COPY` requests.

Check for unexpected file creation, replacement or deletion outside the intended served root.

Identify exposed WebDAV listeners and their running build.

Mitigation and prioritisation

Upgrade to the vendor’s fixed release; prioritise externally reachable instances.

Until patched, disable WebDAV or restrict it to trusted networks and authenticated clients.

Separate tenant storage and limit the service account’s write access.

Test WebDAV-dependent workflows before rollout; verify filesystem changes afterwards. KEV and EPSS data are needed to determine whether priority-1 handling applies.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.