CVE-2026-71312 rclone CVE debrief

Who should care

Defenders responsible for systems using rclone for syncing with cloud storage providers, especially those with server-side hashing enabled, should assess exposure and prioritize upgrading to version 1.75.0 or later.

Why it matters

The vulnerability in rclone allows for potential code execution via specially crafted filenames during server-side hashing, impacting systems using rclone for syncing with cloud storage providers. Defenders should prioritize upgrading to version 1.75.0 or later and assess exposure.

• Potential code execution as the victim SSH account
• Possible unauthorized access to sensitive data
• Elevation of privileges for an attacker
• Need for verification of server-side hashing configuration

Technical summary

The rclone command-line program, used for syncing files and directories to and from different cloud storage providers, had a vulnerability prior to version 1.75.0. The issue was caused by the interpolation of remote SFTP paths into PowerShell hash commands in the backend/sftp/sftp.go file. Specifically, the quoteOrEscapeShellPath function only escaped ASCII apostrophes, while PowerShell also treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters. This allowed an attacker-controlled filename to terminate the intended path literal and append PowerShell statements, potentially leading to code execution as the victim SSH account when server-side hashing was invoked.

Defensive priority

Defenders should prioritize upgrading to rclone version 1.75.0 or later to mitigate this vulnerability. Systems using rclone for syncing with cloud storage providers, especially those with server-side hashing enabled, should be assessed for exposure.

Recommended defensive actions

• Upgrade to rclone version 1.75.0 or later
• Assess systems using rclone for syncing with cloud storage providers, especially those with server-side hashing enabled, for exposure
• Verify that server-side hashing is not enabled for untrusted or attacker-controlled filenames
• Perform a thorough review of system configurations and user permissions to prevent potential exploitation
• Implement additional monitoring and logging to detect suspicious activity related to rclone usage
• Conduct a vulnerability scan to identify any other potential weaknesses in the environment
• Review and update incident response plans to include procedures for handling potential rclone-related security incidents

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 1.75.0. However, specific details about exploitation or affected systems are not provided, limiting the ability to assess the full scope of the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.