rclone vulnerabilities (Bitnami)
43 vulnerabilities.
-
rcloneBitnami Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url 6.0 Medium -
rcloneBitnami Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim 7.0 High -
rcloneBitnami Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback 7.6 High -
rcloneBitnami Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests 6.9 Medium -
rcloneBitnami rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots 8.2 High -
rcloneBitnami Rclone before 1.75.2 Path Traversal via serve webdav MKCOL 8.7 High -
rcloneBitnami rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect 6.3 Medium -
rcloneBitnami rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS 7.7 High -
rcloneBitnami rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow 6.9 Medium -
rcloneBitnami Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads 6.1 Medium -
rcloneBitnami rclone serve docker Path Traversal via Volume Name 4.6 Medium -
rcloneBitnami rclone before 1.75.1 Path Traversal via Directory Listing Names 2.3 Low -
rcloneBitnami rclone: source object names can escape the configured root on upload 5.3 Medium -
rcloneBitnami rclone: S3 multipart declared-length memory exhaustion 7.5 High -
rcloneBitnami rclone: RC per-server auth-proxy bypass 9.1 Critical -
rcloneBitnami rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass 9.8 Critical -
rcloneBitnami rclone: FTP cross-session auth-proxy backend confusion 7.3 High -
rcloneBitnami rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination 7.1 High -
rcloneBitnami rclone local: crafted Range request against a translated symlink panics (DoS) 5.3 Medium -
rcloneBitnami rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace 6.3 Medium -
rcloneBitnami rclone: http backend forwards custom/auth headers to a different host on redirect 3.7 Low -
rcloneBitnami rclone before 1.75.0 Authentication Bypass via pprof 6.9 Medium -
rcloneBitnami rclone Archive Backend SquashFS Parser Denial of Service 7.1 High -
rcloneBitnami rclone: Local Encoding Path Traversal 6.9 Medium -
rcloneBitnami rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect 9.3 Critical -
rcloneBitnami rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution 8.0 High -
rcloneBitnami rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect 6.0 Medium -
rcloneBitnami rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines 6.4 Medium -
rcloneBitnami rclone before v1.75.0 Credential Exposure via S3 Redirect 6.0 Medium -
rcloneBitnami rclone serve s3 Path Traversal via dot-dot object keys 6.9 Medium -
rcloneBitnami rclone before v1.75.0 Denial of Service via TUS nil-response panic 6.0 Medium -
rcloneBitnami rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory 5.9 Medium -
rcloneBitnami rclone: Incomplete path validation allows backend root escape in serve restic 8.6 High -
rcloneBitnami rclone before 1.74.4 Privilege Escalation via setuid Metadata 2.0 Low -
rcloneBitnami rclone before v1.75.0 Information Disclosure via RC API 5.1 Medium -
rcloneBitnami rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories 8.8 High -
rcloneBitnami rclone archive extract allows S3 destination prefix escape via crafted archive paths 5.0 Medium -
rcloneBitnami rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote 7.5 High -
rcloneBitnami Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix 9.8 Critical -
rcloneBitnami RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution 9.2 Critical -
rcloneBitnami Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution 9.2 Critical -
rcloneBitnami Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata 5.4 Medium -
rcloneBitnami Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone 7.5 High