CVE-2026-59733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-59733", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-06T15:34:16.917Z", "datePublished": "2026-07-14T21:38:37.116Z", "dateUpdated": "2026-07-29T19:26:44.815Z"}, "containers": {"cna": {"title": "rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg"}, {"name": "https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d"}, {"name": "https://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139"}, {"name": "https://github.com/rclone/rclone/releases/tag/v1.74.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/releases/tag/v1.74.4"}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"version": "< 1.74.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T21:38:37.116Z"}, "descriptions": [{"lang": "en", "value": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4."}], "source": {"advisory": "GHSA-fqj9-69pf-6pjg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59733", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T03:55:26.898998Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T19:26:44.815Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-59733", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T03:55:26.898998Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T13:20:42.760Z"}}], "cna": {"title": "rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories", "source": {"advisory": "GHSA-fqj9-69pf-6pjg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": "< 1.74.4"}]}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg", "name": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d", "name": "https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139", "name": "https://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rclone/rclone/releases/tag/v1.74.4", "name": "https://github.com/rclone/rclone/releases/tag/v1.74.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T21:38:37.116Z"}}}, "cveMetadata": {"cveId": "CVE-2026-59733", "state": "PUBLISHED", "dateUpdated": "2026-07-29T19:26:44.815Z", "dateReserved": "2026-07-06T15:34:16.917Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T21:38:37.116Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rclone", "vendor": "rclone", "versions": [{"status": "affected", "version": "< 1.74.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "matchCriteriaId": "772F2000-4F9C-4DF7-ABE9-F30E43F058BF", "versionEndExcluding": "1.74.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4."}], "id": "CVE-2026-59733", "lastModified": "2026-07-29T20:17:04.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59733", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-16T03:55:26.898998Z", "version": "2.0.3"}}]}, "published": "2026-07-14T22:17:30.050", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rclone/rclone/releases/tag/v1.74.4"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rclone: Rclone: Unauthorized access to private repositories via directory traversal", "id": "2500770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500770"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Rclone. When using the `rclone serve restic --private-repos` command, an authenticated user can include directory traversal sequences (e.g., `..`) in a request. This allows them to bypass authorization and read, overwrite, or delete another user's private repository on backends that clean path components. This vulnerability can lead to significant information disclosure, data integrity issues, and denial of service for other users' data."], "mitigation": {"lang": "en:us", "value": "Update to the latest version of rclone from Fedora/EPEL repositories when the fix becomes available. If using rclone serve, restrict access to trusted networks or disable the serve functionality until patched."}, "name": "CVE-2026-59733", "public_date": "2026-07-14T21:38:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-59733\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59733\nhttps://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d\nhttps://github.com/rclone/rclone/commit/dade21c1616035b044df0eef7ee6a85aeb06a139\nhttps://github.com/rclone/rclone/releases/tag/v1.74.4\nhttps://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg"], "statement": "Red Hat does not ship rclone in its enterprise product line. The affected component is available in Fedora and EPEL community repositories only.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.74.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-07-15T14:45:03.223656+00:00", "updated": "2026-08-01T09:15:03.322373+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}