rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
rclone: http backend forwards custom/auth headers to a different host on redirect
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
rclone local: crafted Range request against a translated symlink panics (DoS)
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
rclone: RC per-server auth-proxy bypass
rclone: FTP cross-session auth-proxy backend confusion
rclone: source object names can escape the configured root on upload
rclone: S3 multipart declared-length memory exhaustion
rclone: Local Encoding Path Traversal
rclone archive extract allows S3 destination prefix escape via crafted archive paths
rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys
rclone: Path traversal in serve s3 allows reading and overwriting root-level files
rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
rclone: Incomplete path validation allows backend root escape in serve restic
rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
rclone: Verbose Stack Trace Disclosure in RC API Error Responses
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
Kopia: RCE via SSH ProxyCommand Injection
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
Ollama is Vulnerable to Path Traversal
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution