Technical impact
Rclone prior to version 1.75.2 contains a path traversal flaw in its WebDAV serving feature. An unauthenticated attacker can send an MKCOL request that includes an unvalidated '..' path component, which causes the server to create a node above the intended served root. Once such a node exists, the attacker can use subsequent MKCOL, PUT, MOVE, or COPY operations to create, overwrite, or delete files belonging to other tenants or the underlying filesystem. This enables a remote attacker to tamper with files, potentially leading to privilege escalation or data loss. The weakness is classified as a Path Traversal problem (CWE‑22).
Affected Systems
The vulnerability affects the rclone command‑line tool, specifically any deployment running a rclone version earlier than 1.75.2. The issue is present in the serve webdav command and can be triggered on any host that exposes this service without additional access controls.
Risk and Exploitability
The CVSS score for this vulnerability is 8.7, indicating high impact. The EPSS score is not available, so the current exploit probability cannot be precisely quantified, but the lack of authentication and the simplicity of the MKCOL abuse suggest that exploitation is likely feasible in environments where WebDAV is exposed. The vulnerability is not listed in CISA’s KEV catalog, yet its potential to compromise multiple tenants makes it highly relevant for organizations running shared instances of rclone. Attackers can reach this flaw remotely by crafting a WebDAV MKCOL request containing '..', a pathway that requires no privileged credentials and therefore poses a significant risk to platform integrity and confidentiality.
