# CVE-2026-71313: rclone path traversal in local backend via custom filename encoding

Source: https://junglewise.ai/threats/cve-2026-71313-rclone-path-traversal-in-local-backend-via-custom-filename  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-71313 · Severity: medium · CVSS 6.9 · Published 2026-08-05

rclone, a popular command-line tool for managing files on cloud storage, is vulnerable to a path traversal flaw when using certain non-default local encoding settings. An attacker who can control file names on a source storage system (like Amazon S3) could craft malicious names that, when synchronized or copied by a victim, cause rclone to create or overwrite files outside of the intended destination folder. This could lead to the corruption of important system files or unauthorized modification of data with the permissions of the user running rclone.

Technologies: [github.com/rclone/rclone (Go)](https://junglewise.ai/threats/technologies/github-com-rclone-rclone), [Rclone](https://junglewise.ai/threats/technologies/rclone). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Rclone](https://junglewise.ai/threats/vendors/rclone).

## Quick answers

**Is CVE-2026-71313 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71313 being exploited in the wild.

**How severe is CVE-2026-71313?** Medium severity, with a CVSS score of 6.9, published 5 August 2026.

**Which products and versions are affected?** github.com/rclone/rclone (Go) >= 1.51.0, <= 1.74.4, SEMVER:introduced=1.51.0,fixed=1.75.0; Rclone v1.51.0 - v1.74.4.

**Is there a fix for CVE-2026-71313?** Yes. github.com/rclone/rclone (Go): upgrade to 1.75.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71313 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71313?** Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rclone/rclone (Go): upgrade to 1.75.0 or later

  ```sh
  go get github.com/rclone/rclone@v1.75.0
  ```


## Technical details

The vulnerability exists in the local backend's path resolution logic. When a local destination is configured with an encoding that omits 'Dot' (e.g., --local-encoding Raw), rclone's internal fullwidth character representation for relative path components (．．) is decoded back into literal '..' components. The `backend/local.localPath` function then joins this decoded string with the destination root using `filepath.Join`, which resolves the traversal and escapes the root. On Windows, a similar bypass occurs if 'BackSlash' is omitted from the encoding mask. The root cause is a lack of post-conversion path validation (such as a `filepath.Rel` check) to ensure the final native path remains within the configured destination. The issue is patched in version 1.75.0.

## Affected products

- rclone rclone v1.51.0 - v1.74.4

## Identifiers

- CVE-2026-71313
- GHSA-7p4m-qxvv-g567
- GO-2026-6186

## Timeline

- 2026-07-31: advisory: GitHub Advisory GHSA-7p4m-qxvv-g567 published
- 2026-08-05: patched: Version 1.75.0 released

## References

- [https://api.github.com/users/cyberlanc3r](https://api.github.com/users/cyberlanc3r)
- [https://github.com/cyberlanc3r](https://github.com/cyberlanc3r)
- [https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D](https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D)
- [https://api.github.com/users/cyberlanc3r/repos](https://api.github.com/users/cyberlanc3r/repos)
- [https://avatars.githubusercontent.com/u/216992819?v=4](https://avatars.githubusercontent.com/u/216992819?v=4)
- [https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D](https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D)

## Related threats

- [Rclone B2 backend credential exposure on HTTP redirects](https://junglewise.ai/threats/cve-2026-116196-rclone-before-v1-75-2-contains-a-credential-exposure)
- [Rclone path traversal in translateLink function](https://junglewise.ai/threats/cve-2026-116195-rclone-before-1-75-2-contains-a-path-traversal-vulnerability-in)
- [Rclone cross-site request forgery in pCloud OAuth callback](https://junglewise.ai/threats/cve-2026-116194-rclone-from-1-52-0-before-1-75-2-contains-a-cross-site-request)
- [Rclone serve webdav authentication bypass via OPTIONS requests](https://junglewise.ai/threats/cve-2026-116193-rclone-from-1-64-0-before-1-75-2-contains-an-authentication)
- [rclone server-side request forgery via --rc-serve scheme-relative roots](https://junglewise.ai/threats/cve-2026-116192-rclone-from-1-37-before-1-74-2-contains-a-server-side-request)