Is CVE-2026-71313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71313 being exploited in the wild.

How severe is CVE-2026-71313?

Medium severity, with a CVSS score of 6.9, published 5 August 2026.

Which products and versions are affected?

github.com/rclone/rclone (Go) >= 1.51.0, <= 1.74.4, SEMVER:introduced=1.51.0,fixed=1.75.0; Rclone v1.51.0 - v1.74.4.

Is there a fix for CVE-2026-71313?

Yes. github.com/rclone/rclone (Go): upgrade to 1.75.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71313 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71313?

Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71313: rclone path traversal in local backend via custom filename encoding

Q: Is there a fix for CVE-2026-71313?

Yes. github.com/rclone/rclone (Go): upgrade to 1.75.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71313 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-71313?

Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71313 · Severity: medium · CVSS 6.9 · Published 2026-08-05

rclone, a popular command-line tool for managing files on cloud storage, is vulnerable to a path traversal flaw when using certain non-default local encoding settings. An attacker who can control file names on a source storage system (like Amazon S3) could craft malicious names that, when synchronized or copied by a victim, cause rclone to create or overwrite files outside of the intended destination folder. This could lead to the corruption of important system files or unauthorized modification of data with the permissions of the user running rclone.

Technologies: github.com/rclone/rclone (Go), Rclone. Vendors: Go, Rclone.

Quick answers

Is CVE-2026-71313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71313 being exploited in the wild.
How severe is CVE-2026-71313?: Medium severity, with a CVSS score of 6.9, published 5 August 2026.
Which products and versions are affected?: github.com/rclone/rclone (Go) >= 1.51.0, <= 1.74.4, SEMVER:introduced=1.51.0,fixed=1.75.0; Rclone v1.51.0 - v1.74.4.
Is there a fix for CVE-2026-71313?: Yes. github.com/rclone/rclone (Go): upgrade to 1.75.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71313 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71313?: Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rclone/rclone (Go): upgrade to 1.75.0 or later
```
go get github.com/rclone/rclone@v1.75.0
```

Technical details

The vulnerability exists in the local backend's path resolution logic. When a local destination is configured with an encoding that omits 'Dot' (e.g., --local-encoding Raw), rclone's internal fullwidth character representation for relative path components (．．) is decoded back into literal '..' components. The `backend/local.localPath` function then joins this decoded string with the destination root using `filepath.Join`, which resolves the traversal and escapes the root. On Windows, a similar bypass occurs if 'BackSlash' is omitted from the encoding mask. The root cause is a lack of post-conversion path validation (such as a `filepath.Rel` check) to ensure the final native path remains within the configured destination. The issue is patched in version 1.75.0.

Affected products

rclone rclone v1.51.0 - v1.74.4

Identifiers

CVE-2026-71313
GHSA-7p4m-qxvv-g567
GO-2026-6186

Timeline

2026-07-31: advisory: GitHub Advisory GHSA-7p4m-qxvv-g567 published
2026-08-05: patched: Version 1.75.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.