CVE-2026-71309

Summary

rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.

The issue affects rclone v1.40 through rclone v1.74.4. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for v1.74.4, and the latest master commit reviewed at the time (2217d38) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process.

Affected versions

All releases from v1.40 through v1.74.4 are affected.

Affected components and backend propagation

The primary vulnerable component is the backend-independent WithRemote middleware in cmd/serve/restic/restic.go, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV.

The backend determines whether the accepted ../ path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing:

Layer or backend	File and function	Relevant lines	Path propagation	Dynamic evidence
REST server, primary cause	cmd/serve/restic/restic.go, WithRemote	235-264	Accepts a leading ../ remote and shares it with GET, HEAD, POST, and DELETE handlers	Confirmed through WebDAV
WebDAV	backend/webdav/webdav.go, (*Fs).filePath	421-427	path.Join(f.root, file) removes the configured root when resolving ../	read, write, delete
FTP	backend/ftp/ftp.go, (*Fs).NewObject, (*Object).Open, Update, and Remove	844-848, 1308-1311, 1349-1356, 1411-1415	Each operation joins the backend root and remote with path.Join before the FTP request	read, write, delete
HTTP	backend/http/http.go, (*Fs).url	386-395	Appends the escaped remote containing ../ to the configured endpoint URL	read
Memory	backend/memory/memory.go, (*Fs).split	227-231	Joins f.root and the relative path before splitting the in-memory bucket and key	read, write, delete
SFTP	backend/sftp/sftp.go, (*Fs).remotePath	2086-2089	Joins f.absRoot and the remote, allowing the parent component to remove the published subdirectory	read, write, delete

These are backend-specific manifestations of the same WithRemote validation flaw, not separate vulnerabilities.

Technical Details

WithRemote obtains the decoded URL path, removes external slashes, and tries to reject traversal by comparing the path with path.Clean:

urlpath = strings.Trim(urlpath, "/")
// Reject any non-canonical path, in particular one containing ".."
// traversal elements.
if urlpath != "" && path.Clean(urlpath) != urlpath {
    http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
    return
}

The comment describes the intended behavior, but the condition does not reject every parent component. path.Clean preserves leading parent components in a relative path:

path.Clean("../outside.txt")  = "../outside.txt"
path.Clean("../../outside.txt") = "../../outside.txt"

Because both strings are equal, the middleware accepts the path. Internal traversal behaves differently:

path.Clean("a/../../outside.txt") = "../outside.txt"

These strings differ, so that request returns HTTP 400. This explains why the existing check appears to work while the leading variant bypasses it.

After validation, WithRemote stores the accepted value in the request context:

ctx := context.WithValue(r.Context(), ContextRemoteKey, urlpath)
next.ServeHTTP(w, r.WithContext(ctx))

GET, POST, and DELETE handlers retrieve this same value. GET passes it to s.f.NewObject, POST passes it to operations.RcatSize, and DELETE resolves the object and calls Remove. There is no second containment check.

WebDAV is used below as the concrete end-to-end example because it was the backend used for the main proof of concept. WebDAV is not the source of the validation flaw. The example demonstrates one way in which an unsafe remote accepted by WithRemote is propagated by a backend.

The WebDAV backend joins its configured root with the attacker-controlled remote:

func (f *Fs) filePath(file string) string {
    subPath := path.Join(f.root, file)
    if f.opt.Enc != encoder.EncodeZero {
        subPath = f.opt.Enc.FromStandardPath(subPath)
    }
    return rest.URLPathEscapeAll(subPath)
}

For the proof of concept:

f.root = "served-root"
file = "../outside-secret.txt"

path.Join("served-root", "../outside-secret.txt")
= "outside-secret.txt"

The configured root is removed before encoding. WsgiDAV receives a normal operation for /outside-secret.txt, which is outside the root published by rclone serve restic.

The same accepted leading parent path propagates through the other affected backends tested. FTP joins its root and remote with path.Join before object operations; HTTP preserves served-root/../outside-secret.txt when constructing the endpoint request; Memory joins the root and relative path before splitting the bucket and key; and SFTP joins f.absRoot and the remote in remotePath. In each case, the backend receives the leading parent component already accepted by WithRemote. The exact escape mechanism and available operations vary by backend. Conversely, S3-compatible and local backends did not escape in the tested configuration because they encoded .. as filename characters.

Expected behavior is HTTP 400 before any backend operation. Actual behavior is HTTP 200 followed by an operation outside served-root.

Preconditions and impact

The operator must publish a backend subdirectory, the endpoint must be reachable, and the backend credential must have access to a parent or sibling object. Exploitability also depends on backend path semantics.

An attacker may:

• read files and objects outside the published backup root;
• create or overwrite sibling objects;
• delete objects when deletion is permitted;
• cross isolation boundaries between users, repositories, or automation jobs;
• indirectly compromise another system if it later trusts an overwritten configuration, script, or artifact.

--append-only reduces overwrite and delete impact but does not prevent traversal reads or creation of new objects.

Proof of concept

The following procedure was executed on Linux Mint 22.3 with the official rclone v1.74.4 Linux AMD64 binary, WsgiDAV 4.3.5, and Cheroot 10.0.1. The rclone binary reports that it was built with Go 1.26.5.

1. Create the storage layout

$ mkdir -p poc/storage/served-root
$ printf '%s\n' 'INSIDE-PUBLISHED-ROOT' > poc/storage/served-root/inside.txt
$ printf '%s\n' 'SECRET-OUTSIDE-PUBLISHED-ROOT' > poc/storage/outside-secret.txt
$ find poc/storage -type f
poc/storage/served-root/inside.txt
poc/storage/outside-secret.txt

2. Start the independent WebDAV server

$ python3 -m venv poc/venv
$ poc/venv/bin/pip install 'WsgiDAV==4.3.5' 'cheroot==10.0.1'
$ poc/venv/bin/wsgidav --host=127.0.0.1 --port=39500 \
    --root="$PWD/poc/storage" --auth=anonymous --no-config
Running without configuration file.
...
Server: WsgiDAV/4.3.5 Cheroot/10.0.1 Python/3.12.3

3. Download, verify, and start rclone

$ curl -fLO https://downloads.rclone.org/v1.74.4/rclone-v1.74.4-linux-amd64.zip
$ curl -fLO https://downloads.rclone.org/v1.74.4/SHA256SUMS
$ grep '  rclone-v1.74.4-linux-amd64.zip
#39; SHA256SUMS | sha256sum -c -
rclone-v1.74.4-linux-amd64.zip: OK

$ unzip rclone-v1.74.4-linux-amd64.zip
$ ./rclone-v1.74.4-linux-amd64/rclone version | head -n 1
rclone v1.74.4

$