Approved changes feed: RSS · Atom
cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Rclone (2a90d26e-6f75-5ba6-ad1a-62ffb90508f5) |
|---|---|
| Product | Rclone (14007b47-6d84-556b-9b44-2c4f2feb1425) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/rclone |
purl2cpe | 2026-06-01 10:16:21.505076 |
pkg:deb/ubuntu/rclone |
purl2cpe | 2026-06-01 10:16:21.505080 |
pkg:docker/rclone/rclone |
purl2cpe | 2026-06-01 10:16:21.505083 |
pkg:github/rclone/rclone |
purl2cpe | 2026-06-01 10:16:21.505086 |
pkg:rpm/fedora/rclone |
purl2cpe | 2026-06-01 10:16:21.505089 |
pkg:rpm/opensuse/rclone |
purl2cpe | 2026-06-01 10:16:21.505092 |
pkg:sourceforge/rclone.mirror |
purl2cpe | 2026-06-01 10:16:21.505094 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-116195 |
vulnerable | 2026-11-03 10:15:22.097346 |
Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
MEDIUM (6.1)
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
Published: 2026-10-25T13:20:29.131Z
Updated: 2026-10-26T16:42:00.376Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116191 |
vulnerable | 2026-11-03 10:15:22.074192 |
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
HIGH (7.5)
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
Published: 2026-10-25T13:20:26.490Z
Updated: 2026-10-26T16:42:11.109Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116189 |
vulnerable | 2026-11-03 10:15:22.044232 |
rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
HIGH (7.5)
rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.
Published: 2026-10-25T13:20:25.148Z
Updated: 2026-10-29T19:59:55.648Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116194 |
vulnerable | 2026-11-03 10:15:21.736735 |
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
MEDIUM (6.8)
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter. Malicious web pages can send a stateless request to port 53682 during authorization, planting attacker tokens and API hosts so later transfers reach the attacker.
Published: 2026-10-25T13:20:28.466Z
Updated: 2026-10-29T16:18:52.204Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116190 |
vulnerable | 2026-11-03 10:15:21.713134 |
rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
LOW (3.7)
rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.
Published: 2026-10-25T13:20:25.832Z
Updated: 2026-10-29T16:17:28.780Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116188 |
vulnerable | 2026-11-03 10:15:21.696646 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116196 |
vulnerable | 2026-11-03 10:15:21.568684 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116192 |
vulnerable | 2026-11-03 10:15:21.539120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116193 |
vulnerable | 2026-11-03 10:15:21.445014 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116187 |
vulnerable | 2026-11-03 10:15:21.364494 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93986 |
vulnerable | 2026-10-13 12:28:56.206803 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93987 |
vulnerable | 2026-10-13 12:28:56.057025 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88045 |
vulnerable | 2026-09-16 04:34:09.298458 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88016 |
vulnerable | 2026-09-16 04:34:09.289780 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88013 |
vulnerable | 2026-09-16 04:34:09.233510 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88044 |
vulnerable | 2026-09-16 04:34:09.219957 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88017 |
vulnerable | 2026-09-16 04:34:09.217880 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88046 |
vulnerable | 2026-09-16 04:34:09.172730 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88015 |
vulnerable | 2026-09-16 04:34:09.165242 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88014 |
vulnerable | 2026-09-16 04:34:09.144653 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88018 |
vulnerable | 2026-09-16 04:34:09.133518 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71312 |
vulnerable | 2026-09-16 04:32:59.715038 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71313 |
vulnerable | 2026-09-16 04:32:59.605605 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71311 |
vulnerable | 2026-09-16 04:32:59.393744 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71309 |
vulnerable | 2026-09-16 04:32:59.381147 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71310 |
vulnerable | 2026-09-16 04:32:59.036498 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59733 |
vulnerable | 2026-07-29 01:03:17.571567 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59732 |
vulnerable | 2026-07-29 01:03:17.571217 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54572 |
vulnerable | 2026-07-29 01:00:27.896723 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49980 |
vulnerable | 2026-07-29 00:57:45.804749 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41179 |
vulnerable | 2026-06-08 08:03:15.028824 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41176 |
vulnerable | 2026-06-08 08:03:15.010556 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-52522 |
vulnerable | 2026-06-08 06:52:15.344326 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28924 |
vulnerable | 2026-06-08 05:23:56.602854 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.