A flaw in the rclone FTP backend allows an attacker to craft a filename that contains CR and LF characters. When this filename is used with a nondefault FTP encoding, the data is forwarded to the FTP control channel unchanged, creating a secondary FTP command. This injection can execute commands such as DELE or NOOP under the credentials of the user running rclone, potentially leading to unauthorized file deletion, data loss, or disruption of the target FTP server. The weakness is a command injection identified as CWE‑93, and it is rated with a CVSS score of 6.4.

The vulnerability affects the rclone command‑line program from the rclone project. Any installation of rclone prior to version 1.75.0 that enables a custom FTP filename encoding is susceptible. The specific product is the rclone binary used for syncing files to or from FTP services.

The CVSS score of 6.4 places this issue in the medium severity range. No EPSS data is available and the vulnerability is not listed in CISA KEV, indicating that it is not yet widely exploited. The attack likely requires an attacker to supply a specially crafted filename during a sync or copy operation to a remote FTP destination that is being accessed with elevated privileges. Once the command is sent, the attacker can leverage the remote FTP session to perform additional operations within the context of the account used by rclone. Because the flaw resides in command argument construction, the attack vector is local to the system running rclone, but results in impact on a remote FTP server.