rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the con
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path syntax, so a local destination using Slash, None, Raw, or on Windows an encoding that preserves backslash can decode a standard-encoded fullwidth dot-dot component or native backslash form into an actual p
Affected packages
- rclone
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://www.cve.org/CVERecord?id=CVE-2026-71313
- https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567
- https://github.com/rclone/rclone/commit/6a69713864b1d8f6edbc03d8af735f9624576d6e
- https://github.com/rclone/rclone/releases/tag/v1.75.0
Structured record: https://ubuntu.com/security/CVE-2026-71313
Recommended response stack
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta