Source: rclone Version: 1.69.3+dfsg-3 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for rclone. CVE-2026-93986[0]: | rclone before 1.75.1 fails to confine names from server and third- | party listing responses to the listed directory, allowing path | traversal sequences in object names. Attackers can craft special | names containing forward slashes and parent directory references to | potentially write outside the destination root, though downstream | protections in the local backend currently block actual file escape. CVE-2026-93987[1]: | rclone versions 1.56.0 through 1.75.0 contain a path traversal | vulnerability in the `rclone serve docker` volume plugin. | newVolume() in cmd/serve/docker/volume.go computes a volume's | mountpoint as filepath.Join(drv.root, name) from the attacker- | supplied `name` field of a Docker VolumeDriver.Create request | without verifying that the result stays within drv.root (default | /var/lib/docker-volumes/rclone), and checkMountpoint() then creates | that directory with file.MkdirAll before mounting. A volume name | containing enough `..` components (e.g. "../../../../../../etc") | therefore resolves outside the base directory, allowing anyone able | to submit a VolumeDriver.Create request to the plugin socket — | normally the Docker daemon, or a workload that can request named | volumes in a multi-tenant orchestration setup — to make the | privileged rclone plugin process create a directory and mount a | remote filesystem specified in the same request at an arbitrary host | path, shadowing or disrupting system directories. The advisory notes | Volume.restoreState() had the same missing validation when reloading | persisted volume state. Fixed in 1.75.1. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-93986 https://www.cve.org/CVERecord?id=CVE-2026-93986 [1] https://security-tracker.debian.org/tracker/CVE-2026-93987 https://www.cve.org/CVERecord?id=CVE-2026-93987 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
