CVE-2026-71311: FTP Command Injection via Path CRLF Injection in rclone FTP Backend

rclone is a command-line utility used to sync, copy, and manage files across various cloud and protocol backends, including File Transfer Protocol (FTP) servers. To support diverse storage systems, rclone translates local filenames to the target protocol using a configurable encoding framework. This translation mechanism ensures that special characters are mapped to acceptable equivalents on the remote filesystem.

The vulnerability is located within backend/ftp/ftp.go and stems from the interaction with the third-party client dependency github.com/jlaffaye/ftp. When users configure rclone to use permissive encoding masks, the encoding engine allows control characters like Carriage Return (\r) and Line Feed (\n) to remain unescaped. This exposes a direct attack surface on the line-oriented FTP control channel.

An attacker who can write files to a source repository synchronized by a victim can place a maliciously named file in the queue. When rclone processes the file path, the raw CRLF sequences are evaluated by the FTP protocol interpreter. This leads to the execution of arbitrary, independent FTP commands within the context of the authenticated session.

The root cause of CVE-2026-71311 lies in a failure to enforce input validation on protocol control boundaries across two separate software layers: rclone's encoding configurations and the input validation limits of the github.com/jlaffaye/ftp library.

FTP commands are transmitted over a line-oriented TCP control channel where commands are terminated by a standard CRLF sequence. The underlying library utilizes Go's standard library textproto.Conn.Cmd method to format and transmit FTP commands such as STOR or DELE. This method writes strings directly to the socket without verifying if the arguments themselves contain embedded carriage returns or line feeds.

Under rclone's default configuration, filenames are passed through an encoder that maps control characters using the Ctl and CrLf masks. However, if a user explicitly overrides this with less restrictive rules such as encoding = Slash or encoding = None, rclone bypasses these security filters. The raw CRLF sequences are preserved within the path variable and sent down to the FTP client library, splitting the single command into multiple protocol instructions.

In vulnerable versions, the initialization function NewFs in backend/ftp/ftp.go instantiated the filesystem configuration without checking if the resolved encoding scheme protected against control character injection. Users could supply configuration structures that omitted critical safety masks.

The remediation patch introduced a dedicated helper function, commandEncoding, which is designed to programmatically enforce CRLF encoding regardless of the user's explicit profile configuration. This is achieved by performing a bitwise OR operation with the encoder.EncodeCrLf mask.

// backend/ftp/ftp.go
 
// commandEncoding hardens the user-configured filename encoding so that it
// can never restore a raw CR or LF.
//
// The FTP control channel is line oriented and the ftp library writes command
// arguments (paths) straight onto it without escaping, so a filename
// containing CR/LF would otherwise be able to inject an independent FTP
// command. CR/LF are therefore always encoded to safe symbols regardless of
// the configured encoding, which is what the default encoding already does.
func commandEncoding(enc encoder.MultiEncoder) encoder.MultiEncoder {
	return enc | encoder.EncodeCrLf
}

In the NewFs constructor, rclone now passes the configured encoding structure through this helper before setting up the operational structures. This ensures that any input path undergoes sanitization, rendering CRLF injection impossible even if the client configuration specifies an encoding of None:

// backend/ftp/ftp.go in NewFs()
 
	opt.Enc = commandEncoding(opt.Enc)

The test suite was also updated to verify that raw carriage returns and line feeds do not persist in paths when using permissive configurations such as encoder.EncodeSlash or encoder.EncodeZero.

Exploitation requires an attacker to have write permissions on a storage source that a victim synchronizes to a privileged FTP destination. The attacker must also target an installation where rclone is configured to use a permissive custom encoding.

The attacker creates a file named victim\r\nDELE target-file.dat\r\nNOOP in the source directory. During the sync sequence, rclone detects the file and prepares an upload request. It builds an FTP STOR command using the raw unescaped name.

STOR victim\r\nDELE target-file.dat\r\nNOOP\r\n

When the remote FTP server receives this byte stream, the protocol interpreter processes it as three discrete, sequential commands:

1. STOR victim - Begins a file upload block.
2. DELE target-file.dat - Deletes the targeted file on the remote server.
3. NOOP - Executes a benign no-operation instruction, gracefully terminating the injection sequence without causing connection failures.

The execution of arbitrary FTP commands within an active session allows attackers to perform unauthorized administrative actions. Since the commands are evaluated with the security context of the authenticated rclone user, any resource the victim has access to can be compromised.

The primary impacts are unauthorized file deletion (DELE), directory removal (RMD), and directory creation (MKD). This allows attackers to disrupt backup routines, remove application data, and manipulate directory structures. In environments with highly privileged FTP accounts, attackers could overwrite critical binary files or configuration structures.

Confidentiality impact is generally limited unless the attacker chains this flaw with commands that move or copy data to public directories. The impact rating of 6.4 reflects high integrity and availability risks, combined with the prerequisite of non-default configurations and specific victim interaction.

Detection can be achieved by auditing active rclone configurations and inspecting system logs. Administrators should inspect rclone.conf files to identify any FTP backend configurations containing encoding = None or encoding = Slash directives.

Network detection involves monitoring FTP control channels (port 21) for anomalous, line-split command transmissions. Normal client behavior will not include administrative command primitives like DELE or RMD embedded within path parameters of transfer requests. System logs that indicate a file transfer command followed immediately by unrelated file actions are high-confidence indicators of exploitation.

# Conceptual Snort / Suricata rule
alert tcp any any -> $FTP_SERVERS 21 (msg:"rclone FTP CRLF Command Injection Attempt"; flow:to_server,established; content:"STOR "; nocase; pcre:"/STOR .*\r\n(DELE|RMD|MKD|RNFR|RNTO) .*\r\n/I"; reference:cve,2026-71311; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation requires upgrading all rclone installations to version 1.75.0 or later. If immediate upgrading is not possible, administrators should remove custom encoding configurations from their FTP profiles, reverting to the default encoding masks that escape control sequences.