CVE-2026-116191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116191", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-25T12:27:12.266Z", "datePublished": "2026-10-25T13:20:26.490Z", "dateUpdated": "2026-10-26T16:42:11.109Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-25T13:20:26.490Z"}, "datePublic": "2026-10-09T00:00:00.000Z", "title": "Rclone before 1.75.2 Path Traversal via serve webdav MKCOL", "descriptions": [{"lang": "en", "value": "Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "rclone", "product": "rclone", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.75.2"}, {"version": "1.75.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.75.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-44pm-2q5p-fm63)"}, {"name": "VulnCheck Advisory: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol"}], "credits": [{"lang": "en", "value": "euriconicacio", "type": "reporter"}, {"lang": "en", "value": "manus-pi", "type": "finder"}, {"lang": "en", "value": "ncw", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-26T15:43:15.573699Z", "id": "CVE-2026-116191", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T16:42:11.109Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T15:43:15.573699Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T15:43:18.236Z"}}], "cna": {"title": "Rclone before 1.75.2 Path Traversal via serve webdav MKCOL", "credits": [{"lang": "en", "type": "reporter", "value": "euriconicacio"}, {"lang": "en", "type": "finder", "value": "manus-pi"}, {"lang": "en", "type": "finder", "value": "ncw"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": "0", "lessThan": "1.75.2", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/rclone/rclone", "defaultStatus": "unaffected"}], "datePublic": "2026-10-09T00:00:00.000Z", "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63", "name": "GitHub Security Advisory (GHSA-44pm-2q5p-fm63)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol", "name": "VulnCheck Advisory: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.75.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-25T13:20:26.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116191", "state": "PUBLISHED", "dateUpdated": "2026-10-26T16:42:11.109Z", "dateReserved": "2026-10-25T12:27:12.266Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-25T13:20:26.490Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "product": "rclone", "vendor": "rclone", "versions": [{"lessThan": "1.75.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D112F07-6051-4781-BC1E-0FDE422EB2A4", "versionEndExcluding": "1.75.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants."}], "id": "CVE-2026-116191", "lastModified": "2026-10-27T14:09:51.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116191", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T15:43:15.573699Z", "version": "2.0.3"}}]}, "published": "2026-10-25T14:16:59.400", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: Arbitrary file modification via path traversal in WebDAV service", "id": "2560410", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560410"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Rclone's Web Distributed Authoring and Versioning (WebDAV) service. Due to improper validation of directory traversal sequences, a remote, unauthenticated attacker can send specially crafted WebDAV requests containing directory traversal sequences. This vulnerability allows the attacker to plant directory nodes and create, overwrite, or delete files outside the intended root directory, potentially compromising data belonging to other tenants."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-116191", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-10-25T13:20:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116191\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116191\nhttps://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63\nhttps://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol"], "statement": "This vulnerability is rated as an Important severity flaw because an unauthenticated network entity can escape the configured directory root to modify or delete arbitrary host files, resulting in a high integrity impact. In typical Red Hat product deployments, rclone functions as a client-side file synchronization tool rather than a persistent network-facing server. Practical exploitation is therefore limited to environments that explicitly launch the WebDAV listener and expose it to untrusted network access.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.75.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.75.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-10-25T17:00:17.453292+00:00", "updated": "2026-10-25T17:45:15.465609+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}