THREAT OPS › Threat News › [GHSA] GHSA-45pq-889g-fcgh (high) — rclone: Incomplete path validation allows backend root escape in serve restic
[GHSA] GHSA-45pq-889g-fcgh (high) — rclone: Incomplete path validation allows backend root escape in serve restic
GHSA-45pq-889g-fcgh Severity: high CVE: CVE-2026-71309
rclone: Incomplete path validation allows backend root escape in serve restic
## Summary
`rclone serve restic` does not correctly reject URL paths beginning with `../`. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.
The issue aff
MITRE ATT&CK techniques
- VulnerabilitiesT1588.006
Indicators of compromise
- CVE-2026-71309cve
- https://downloads.rclone.org/v1.74.4/rclone-v1.74.4-linux-amd64.zipurl
- https://downloads.rclone.org/v1.74.4/SHA256SUMSurl
- http://127.0.0.1:39500url
- http://127.0.0.1:39501/url
- http://127.0.0.1:39501/inside.txturl
- http://127.0.0.1:39501/%2e%2e/outside-secret.txturl
- http://127.0.0.1:39501/%2e%2e/outside-write.txturl
- http://127.0.0.1:39501/a/../../outside-secret.txturl
Original source: https://github.com/advisories/GHSA-45pq-889g-fcgh