Live › vulnerability › CVE-2026-116191
Go to dashboardRclone before 1.75.2 does not validate '..' path components in its serve webdav mode. An unauthenticated attacker can create, overwrite, or delete files outside the served root, including files belonging to other tenants.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running rclone's serve webdav mode that accept requests from users or networks outside their trust boundary, especially multi-tenant setups sharing one served root. Installations that only use rclone as a client, or serve WebDAV only to trusted local users, are less exposed. The sources do not say whether authentication settings change exposure.
No product ranges from the sources yet.
rclone version and compare against 1.75.2.rclone serve webdav and whether it is reachable from untrusted networks.1.75.2 or later.rclone serve webdav to untrusted networks.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
This page as .md · .json · in your agent: get_signal("CVE-2026-116191")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.