---
id: "CVE-2026-116191"
kind: "vulnerability"
aliases: ["CVE-2026-116191"]
title: "Rclone: WebDAV path traversal lets unauthenticated users write outside served root"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multi-tenant", "package", "rclone", "self-hosted", "webdav"]
not_affected_if: ["client-only-use", "no-webdav-serve"]
published_at: "2026-10-25T14:16:59+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116191", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# Rclone: WebDAV path traversal lets unauthenticated users write outside served root

Rclone before 1.75.2 does not validate '..' path components in its serve webdav mode. An unauthenticated attacker can create, overwrite, or delete files outside the served root, including files belonging to other tenants.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `rclone version` and compare against `1.75.2`.
- Check whether the service is started with `rclone serve webdav` and whether it is reachable from untrusted networks.

## Fix

- Upgrade rclone to `1.75.2` or later.
- Until upgraded, stop exposing `rclone serve webdav` to untrusted networks.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116191

## From the sources

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_