A flaw in rclone allows attacker‑controlled SFTP filenames to terminate a PowerShell string literal when the utility builds hash commands for server‑side hashing. The escape routine only handles ASCII apostrophes and fails to quote Unicode ‘smart‑quote’ characters that PowerShell also treats as delimiters, leading to command injection (CWE‑78). The injection causes arbitrary PowerShell statements to run as the victim’s SSH account, giving an attacker the same privileges as the SSH user.

All releases of the rclone command‑line synchronisation tool before version 1.75.0 are vulnerable because the unsafe interpolation logic was in place until that version. Users running any older rclone against an SFTP server that may hold filenames containing Unicode quote characters are at risk.

The flaw carries a CVSS score of 8, classifying it as high severity. It is not listed in CISA’s KEV catalog and no EPSS score is available, but the vulnerability can be triggered by any file name containing smart‑quote characters on a remote SFTP server. An attacker that can control or upload a file with such a name can invoke the server‑side hashing routine and execute arbitrary PowerShell commands through the victim’s SSH credentials. It appears that the attack does not require special privileges on the client machine; this inference comes from the fact that the description does not mention any client‑side privilege escalation steps.