CVE-2026-71312: rclone command injection via PowerShell smart-quotes in SFTP backend

Executive brief

rclone is a command-line program used to manage files on cloud storage and remote servers. A security flaw in how it handles file names on SFTP servers allows an attacker to execute unauthorized commands on the server. By creating a file with a specially crafted name containing 'smart quotes,' an attacker can trick the system into running malicious code when a user performs a file integrity check. This could lead to data theft, file modification, or full control over the user's account on the remote server.

Technical details

The vulnerability is an OS command injection (CWE-78) located in the `backend/sftp` component of rclone. The `quoteOrEscapeShellPath` function incorrectly assumes that only the ASCII apostrophe (U+0027) needs to be escaped for PowerShell environments. However, Windows PowerShell also recognizes four Unicode 'smart quotes' (U+2018, U+2019, U+201A, and U+201B) as valid string delimiters. An attacker with the ability to create or rename files on a remote SFTP server can use these characters to terminate a path literal and append arbitrary PowerShell commands. The exploit is triggered when an rclone user performs an operation that invokes server-side hashing (e.g., `Object.Hash`). This issue is resolved in version 1.75.0.

Affected products

• rclone rclone <= 1.74.4

Timeline

• 2026-07-31: patched: Fix included in version 1.75.0
• 2026-08-05: advisory: GitHub Advisory GHSA-2m8m-jhrm-w6j2 published

References

• https://api.github.com/users/cyberlanc3r
• https://github.com/cyberlanc3r
• https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D
• https://api.github.com/users/cyberlanc3r/repos
• https://avatars.githubusercontent.com/u/216992819?v=4
• https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D