Skip to content
Path Traversal Vulnerability in Rclone WebDAV Services

Path Traversal Vulnerability in Rclone WebDAV Services

First seen 25 Oct 2026, 18:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 19:12 UTC
  • •CVE-2026-116191 affects Rclone versions before 1.75.2, allowing path traversal attacks.
  • •Unauthenticated attackers can manipulate files outside the intended directory via WebDAV.
  • •Immediate upgrade to version 1.75.2 is recommended to mitigate the vulnerability.

A path traversal vulnerability, CVE-2026-116191, has been identified in Rclone versions prior to 1.75.2. This flaw allows unauthenticated attackers to manipulate files outside the intended served directory by sending crafted WebDAV requests. The vulnerability is particularly concerning for internet-facing WebDAV services and multi-tenant storage deployments. Attackers can exploit this flaw to create, overwrite, or delete files belonging to other tenants, posing a significant risk to data integrity. The current exploitation status is unclear as there are no confirmed reports of. Users are advised to upgrade to version 1.75.2 or later to mitigate the risk. Until patched, it is recommended to disable WebDAV or restrict access to trusted networks. The CVSS score for this vulnerability is 8.7, indicating a high severity level.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-25
CVE-2026-116191 published
Rclone vulnerability disclosed, allowing unauthenticated path traversal in WebDAV services.
Redpacketsecurity

More articles in this cluster (3)

Following this threat?

Track CVE-2026-116191 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

What versions of Rclone are affected?
Rclone versions prior to 1.75.2 are affected by this vulnerability.
How can I mitigate this vulnerability?
Upgrade to Rclone version 1.75.2 or later, or disable WebDAV access until patched.
Is there any confirmed exploitation of this vulnerability?
Currently, there are no confirmed reports of active exploitation for CVE-2026-116191.