CVE-2026-116191 rclone CVE debrief

Who should care

Defenders responsible for Rclone deployments, particularly those using the serve webdav functionality, should assess exposure and prioritize verification and remediation. This includes reviewing Rclone version, restricting access to serve webdav, and monitoring for suspicious activity. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-116191 is a path traversal vulnerability in Rclone's serve webdav functionality that allows unauthenticated attackers to write above the served root. Defenders should prioritize verifying and upgrading Rclone, restricting access to serve webdav, and monitoring for suspicious activity.

• Verify and upgrade Rclone to version 1.75.2 or later to prevent exploitation
• Restrict access to serve webdav functionality to prevent unauthorized access
• Monitor for suspicious activity to detect potential exploitation

Technical summary

The vulnerability allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. This can be exploited by sending MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants. The vulnerability was reported in Rclone before version 1.75.2 and defenders should prioritize verifying and upgrading Rclone to version 1.75.2 or later, and restrict access to the serve webdav functionality. Additional technical details may be needed to fully assess the impact.

Defensive priority

Defenders should prioritize verifying and upgrading Rclone to version 1.75.2 or later, and restrict access to the serve webdav functionality.

Recommended defensive actions

• Verify Rclone version and upgrade to 1.75.2 or later
• Restrict access to serve webdav functionality
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported in Rclone before version 1.75.2. The CVE record and NVD entry provide details on the vulnerability. Additional information may be needed to fully assess the impact. Defenders should verify Rclone version, restrict access to serve webdav, and monitor for suspicious activity to detect potential exploitation. The vulnerability allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.