Vulnerability Intelligence Report
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
CVE-2026-116191
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.
Path Traversal
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
EPSS Probability:0.39%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| rclone | rclone | 0 < 1.75.2 (affected), 1.75.2 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-10-25T12:27:12 |
| Published | 2026-10-25T13:20:26 |
| Patch Date | 2026-10-09 |
| Last Updated | 2026-10-26T16:42:11 |
Community Chatter & Buzz