rclone’s serve restic feature incorrectly accepts URL paths starting with '..', allowing the parent directory to be passed to backend handlers. This path traversal flaw lets an attacker read, create, overwrite, or delete objects outside the intended root directory when the REST endpoint is reachable and the backend credentials have access to those broader paths.

Rclone, versions 1.40.0 through 1.74.9 (any release prior to 1.75.0), are affected. The vulnerability applies to all supported backends including WebDAV, FTP, HTTP, Memory, and SFTP.

With a CVSS score of 8.6, the flaw is considered high severity. No EPSS score is available, so the current likelihood of exploitation cannot be quantified, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to reach the rclone REST interface; once exposed, a malicious user can issue arbitrary REST requests that result in path traversal and unauthorized file manipulation.