rclone serve s3 before 1.74.4 is vulnerable to a path traversal flaw triggered by dot-dot segments in S3 object keys. An attacker can craft keys such as "../root-secret.txt" to escape the bucket namespace and access arbitrary files in the serve root directory, causing unauthorized read and write operations that compromise confidentiality and integrity.

The vulnerability affects all rclone installations prior to version 1.74.4. Any deployment using rclone serve s3 in that version range is susceptible if the service is reachable from external clients.

With a CVSS score of 6.9 the flaw is moderate in severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating no current widespread exploitation evidence. The likely attack vector is remote, via the S3-compatible API, where an attacker sends specially crafted object key requests to the running rclone service.