rclone vulnerabilities (Debian)
41 vulnerabilities.
-
rcloneDebian Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url 6.0 Medium -
rcloneDebian Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback 7.6 High -
rcloneDebian rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots 8.2 High -
rcloneDebian Rclone before 1.75.2 Path Traversal via serve webdav MKCOL 8.7 High -
rcloneDebian rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect 6.3 Medium -
rcloneDebian rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS 7.7 High -
rcloneDebian rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow 6.9 Medium -
rcloneDebian rclone serve docker Path Traversal via Volume Name 4.6 Medium -
rcloneDebian rclone before 1.75.1 Path Traversal via Directory Listing Names 2.3 Low -
rcloneDebian rclone: source object names can escape the configured root on upload 5.3 Medium -
rcloneDebian rclone: S3 multipart declared-length memory exhaustion 7.5 High -
rcloneDebian rclone: RC per-server auth-proxy bypass 9.1 Critical -
rcloneDebian rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass 9.8 Critical -
rcloneDebian rclone: FTP cross-session auth-proxy backend confusion 7.3 High -
rcloneDebian rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination 7.1 High -
rcloneDebian rclone local: crafted Range request against a translated symlink panics (DoS) 5.3 Medium -
rcloneDebian rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace 6.3 Medium -
rcloneDebian rclone: http backend forwards custom/auth headers to a different host on redirect 3.7 Low -
rcloneDebian rclone before 1.75.0 Authentication Bypass via pprof 6.9 Medium -
rcloneDebian rclone Archive Backend SquashFS Parser Denial of Service 7.1 High -
rcloneDebian rclone: Local Encoding Path Traversal 6.9 Medium -
rcloneDebian rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect 9.3 Critical -
rcloneDebian rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution 8.0 High -
rcloneDebian rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect 6.0 Medium -
rcloneDebian rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines 6.4 Medium -
rcloneDebian rclone before v1.75.0 Credential Exposure via S3 Redirect 6.0 Medium -
rcloneDebian rclone serve s3 Path Traversal via dot-dot object keys 6.9 Medium -
rcloneDebian rclone before v1.75.0 Denial of Service via TUS nil-response panic 6.0 Medium -
rcloneDebian rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory 5.9 Medium -
rcloneDebian rclone: Incomplete path validation allows backend root escape in serve restic 8.6 High -
rcloneDebian rclone before 1.74.4 Privilege Escalation via setuid Metadata 2.0 Low -
rcloneDebian rclone before v1.75.0 Information Disclosure via RC API 5.1 Medium -
rcloneDebian rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories 8.8 High -
rcloneDebian rclone archive extract allows S3 destination prefix escape via crafted archive paths 5.0 Medium -
rcloneDebian rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote 7.5 High -
rcloneDebian Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix 9.8 Critical -
rcloneDebian RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution 9.2 Critical -
rcloneDebian Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution 9.2 Critical -
rcloneDebian Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata 5.4 Medium -
rcloneDebian Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone 7.5 High -
rcloneDebian golang.org/x/crypto/salsa20/salsa uses insufficiently random values 5.9 Medium