7.5Yüksek
CVE-2026-116191Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Açıklama
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
Zayıflık türü (CWE):
CWE-22
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-44pm-2q5p-fm63) vendor-advisoryVendor Advisory
- VulnCheck Advisory: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL third-party-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*< 1.75.2