CVE-2026-71311

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71311", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-05T18:14:42.064Z", "datePublished": "2026-08-05T20:33:32.558Z", "dateUpdated": "2026-08-06T18:44:51.691Z"}, "containers": {"cna": {"title": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"}, {"name": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"}, {"name": "https://github.com/rclone/rclone/releases/tag/v1.75.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"version": "< 1.75.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-05T20:33:32.558Z"}, "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."}], "source": {"advisory": "GHSA-8c48-q9wj-3w37", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T18:41:49.120682Z", "id": "CVE-2026-71311", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T18:44:51.691Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71311", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-05T18:14:42.064Z", "datePublished": "2026-08-05T20:33:32.558Z", "dateUpdated": "2026-08-06T18:44:51.691Z"}, "containers": {"cna": {"title": "rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"}, {"name": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"}, {"name": "https://github.com/rclone/rclone/releases/tag/v1.75.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"version": "< 1.75.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-05T20:33:32.558Z"}, "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."}], "source": {"advisory": "GHSA-8c48-q9wj-3w37", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71311", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T18:41:49.120682Z"}}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T18:42:42.783Z"}}]}}

{"affected": [{"affectedData": [{"product": "rclone", "vendor": "rclone", "versions": [{"status": "affected", "version": "< 1.75.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0."}], "id": "CVE-2026-71311", "lastModified": "2026-09-09T20:50:00.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71311", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T18:41:49.120682Z", "version": "2.0.3"}}]}, "published": "2026-08-05T21:16:58.727", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: FTP command injection via CRLF in filename encoding", "id": "2511771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511771"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in rclone, a command-line program for syncing files. A remote attacker could exploit a vulnerability in the FTP backend's filename encoding. When a non-default encoding is used, specially crafted filenames containing carriage return and line feed (CRLF) characters can be injected into the FTP control channel. This allows an attacker to execute arbitrary FTP commands on a more-privileged FTP destination when a victim copies or syncs files, leading to integrity and availability loss within that account."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid configuring `rclone` FTP backends with non-default filename encodings that allow raw carriage return or line feed characters. If such a configuration is unavoidable, ensure that all filenames processed by `rclone` from untrusted sources are validated to prevent the injection of arbitrary FTP commands. Additionally, restrict the privileges of the FTP destination to minimize the impact of any potential command injection."}, "name": "CVE-2026-71311", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-05T20:33:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71311\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71311\nhttps://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c\nhttps://github.com/rclone/rclone/releases/tag/v1.75.0\nhttps://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37"], "statement": "This Moderate flaw in rclone allows for FTP command injection when a non-default FTP filename encoding is configured that does not properly handle control characters. Exploitation requires a victim to copy or sync an attacker-controlled filename to a more-privileged FTP destination, limiting the attack's broad applicability.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.75.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-08-05T21:30:16.207742+00:00", "updated": "2026-08-05T21:30:16.323538+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}