rclone path traversal in serve s3

Executive brief

rclone is a command-line program used to manage files on cloud storage. A vulnerability in its S3 server component allows users to access or overwrite files outside of their assigned 'bucket' folder. This could lead to the exposure of sensitive configuration files or the corruption of data stored on the server's root directory.

Technical details

A path traversal vulnerability exists in the 'rclone serve s3' command due to improper path normalization. The S3 backend uses 'path.Join' to combine bucket names and object keys; however, 'path.Join' normalizes '..' segments, allowing an attacker to escape the bucket directory. By sending a specially crafted S3 request (e.g., GET /bucket/../secret.txt), an attacker can access or overwrite files located at the root of the served directory. This exploit is possible even without authentication if the server is configured for anonymous access. The vulnerability is patched in version 1.74.4.

Affected products

• rclone rclone <= 1.74.3

Timeline

• 2026-07-08: disclosed
• 2026-07-08: patched: Version 1.74.4 released
• 2026-08-05: advisory

References

• https://api.github.com/users/Dangel165
• https://github.com/Dangel165
• https://api.github.com/users/Dangel165/gists%7B/gist_id%7D
• https://api.github.com/users/Dangel165/repos
• https://avatars.githubusercontent.com/u/180247239?v=4
• https://api.github.com/users/Dangel165/events%7B/privacy%7D