Rclone Before 1.75.2 Path Traversal Via Serve Webdav Mkcol

Back www.vulncheck.com

Rclone Before 1.75.2 Path Traversal Via Serve Webdav Mkcol

www.vulncheck.com • October 25, 2026

Share: View original

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

GitHub Security Advisory (GHSA-44pm-2q5p-fm63)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Path Traversal Vulnerability in Rclone WebDAV Services A path traversal vulnerability, CVE-2026-116191, has been identified in Rclone versions prior to 1.75.2. This flaw allows unauthenticated attackers to manipulate files outside the intended served directory by sending crafted WebDAV requests. The vulnerability is particularly concerning for internet-facing WebDAV services and multi-tenant storage deployments. Attackers can exploit this flaw to create, overwrite, or delete files belonging to other tenants, posing a significant risk to data integrity. The current exploitation status is unclear as there are no confirmed reports of. Users are advised to upgrade to version 1.75.2 or later to mitigate the risk. Until patched, it is recommended to disable WebDAV or restrict access to trusted networks. The CVSS score for this vulnerability is 8.7, indicating a high severity level. 1 sources 63

Extracted Entities

CWE Weaknesses (1)

CWE-22 - Path Traversal

Vulnerabilities (1)