https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-88018.htmlhttps://patchthecve.com/cve/CVE-2026-88018.htmlMon, 14 Sep 2026 20:01:05 +0000CRITICAL 9.8: rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 thttps://patchthecve.com/cve/CVE-2026-88017.htmlhttps://patchthecve.com/cve/CVE-2026-88017.htmlMon, 14 Sep 2026 20:00:53 +0000HIGH 7.3: rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the crehttps://patchthecve.com/cve/CVE-2026-88016.htmlhttps://patchthecve.com/cve/CVE-2026-88016.htmlTue, 15 Sep 2026 15:17:24 +0000HIGH 7.1: rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetahttps://patchthecve.com/cve/CVE-2026-88015.htmlhttps://patchthecve.com/cve/CVE-2026-88015.htmlWed, 23 Sep 2026 20:42:27 +0000MEDIUM 5.3: rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.https://patchthecve.com/cve/CVE-2026-88014.htmlhttps://patchthecve.com/cve/CVE-2026-88014.htmlWed, 23 Sep 2026 20:39:36 +0000MEDIUM 6.3: rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleahttps://patchthecve.com/cve/CVE-2026-88013.htmlhttps://patchthecve.com/cve/CVE-2026-88013.htmlWed, 23 Sep 2026 20:28:10 +0000LOW 3.7: rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirhttps://patchthecve.com/cve/CVE-2026-59733.htmlhttps://patchthecve.com/cve/CVE-2026-59733.htmlWed, 29 Jul 2026 20:17:04 +0000HIGH 8.8: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowinghttps://patchthecve.com/cve/CVE-2026-59732.htmlhttps://patchthecve.com/cve/CVE-2026-59732.htmlTue, 21 Jul 2026 16:17:18 +0000MEDIUM 5.0: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../https://patchthecve.com/cve/CVE-2026-54572.htmlhttps://patchthecve.com/cve/CVE-2026-54572.htmlFri, 17 Jul 2026 03:13:56 +0000HIGH 7.5: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-control