CVE-2026-71312: OS Command Injection via Unicode Smart Quote Shell Bypass in rclone SFTP Backend

The rclone utility is a command-line application used to synchronize, transfer, and manage files across various storage providers. To minimize network resource usage during synchronization or validation phases, rclone supports server-side hashing operations within its SFTP backend (backend/sftp/sftp.go). This optimization operates by establishing an SSH connection and running diagnostic command-line utilities directly on the remote SFTP host rather than downloading entire files to perform hashing locally.

Because the commands are constructed on the client and executed on the remote system, the names of files and directories must be safely formatted as command-line arguments. This interaction exposes an attack surface where file path data acts as input to the shell interpreter running on the remote host. If an attacker can manipulate files in an SFTP repository, they can introduce malicious input that alters the structure of the executed shell command.

The vulnerability, tracked as CVE-2026-71312, belongs to the OS Command Injection class (CWE-78). It arises due to a character-set sanitization mismatch between rclone's Go-based validation routines and the Windows PowerShell interpreter. In environments where the remote SFTP host runs Windows and executes commands via PowerShell, an attacker can bypass standard sanitization routines to achieve unauthenticated remote code execution within the context of the active SSH user session.

To understand the root cause of CVE-2026-71312, one must analyze how rclone handles paths for PowerShell environments. When configuring remote calls, the SFTP backend relies on a validation helper function named quoteOrEscapeShellPath to sanitize path strings. Prior to the fix in version 1.75.0, this function sanitized PowerShell arguments by wrapping the entire path inside ASCII single-quote (') delimiters and doubling any literal ASCII single-quote characters present in the file name.

While doubling an ASCII single quote is the correct escaping syntax for PowerShell string literals, the sanitization mechanism assumed that the standard single quote was the only character capable of terminating a single-quoted string literal. This assumption is incorrect when targeting a Windows PowerShell interpreter. The PowerShell lexer is designed to recognize and support several Unicode smart quote characters as syntactically identical to the ASCII single quote.

These Unicode smart quotes include the Left Single Quotation Mark (‘, U+2018), the Right Single Quotation Mark (’, U+2019), the Single Low-9 Quotation Mark (‚, U+201a), and the Single High-Reversed-9 Quotation Mark (‛, U+201b). Because the vulnerable version of rclone only neutralized the standard ASCII single quote, filenames containing any of these Unicode smart quotes were forwarded to the remote host without modification or escaping.

When the remote Windows host processed the constructed command, the PowerShell lexer matched the leading ASCII single quote delimiter with the first occurrence of a Unicode smart quote in the file path. The lexer interpreted the smart quote as the closing boundary of the string literal, while all subsequent characters in the filename were parsed as live, executable PowerShell code rather than static string content. This parsing behavior allows an attacker to completely escape the string literal and inject arbitrary shell statements.

The core vulnerability resides within backend/sftp/sftp.go. The original sanitization routine was implemented using simple string substitution for ASCII single quotes. The following code comparison highlights the vulnerability and the subsequent fix introduced in version 1.75.0.

// Vulnerable implementation in rclone < 1.75.0
func quoteOrEscapeShellPath(shellType string, shellPath string) (string, error) {
	// PowerShell
	if shellType == "powershell" {
		return "'" + strings.ReplaceAll(shellPath, "'", "''") + "'", nil
	}
	// ...
}

In this vulnerable implementation, strings.ReplaceAll only targets the ASCII single quote ('). The Unicode characters U+2018, U+2019, U+201a, and U+201b are left unchanged inside shellPath. To remediate this issue, the maintainers defined a dedicated multi-character replacer using Go's strings.NewReplacer to target all five characters.

// Patched implementation in rclone 1.75.0
var powerShellQuoteEscaper = strings.NewReplacer(
	"'", "''",
	"‘", "‘‘",
	"’", "’’",
	"‚", "‚‚",
	"‛", "‛‛",
)
 
func quoteOrEscapeShellPath(shellType string, shellPath string) (string, error) {
	// PowerShell
	if shellType == "powershell" {
		return "'" + powerShellQuoteEscaper.Replace(shellPath) + "'", nil
	}
	// ...
}

By leveraging strings.NewReplacer, the updated function ensures that if any of the five quote characters are detected inside the path, they are doubled. In PowerShell, doubling a delimiter acts as a literal escape sequence, preserving the character within the string boundary without terminating the string. This implementation effectively prevents command breakout via the PowerShell lexer.

While this fix is complete for single-quoted contexts, developers should remain aware of potential Unicode normalization layers. If a Windows host performs 'Best-Fit' character mappings or unicode normalization (e.g., NFC/NFD transformations) after receiving the arguments, other characters might be converted into quotes. Furthermore, if double-quoted strings are ever used in adjacent command constructions, a similar vulnerability could arise involving smart double quotes such as “ (U+201C) and ” (U+201D), which must be neutralized similarly.

To exploit CVE-2026-71312, an attacker requires write privileges on the remote SFTP share and must wait for, or induce, the victim to execute an rclone operation that triggers server-side hashing on that directory. The primary technical prerequisite is that the target SFTP server must reside on a Windows operating system that uses PowerShell as its default shell for executing SSH terminal commands.

The attack begins with the construction of a malicious filename containing a Unicode smart quote followed by the command payload. For example, the attacker can use the Right Single Quotation Mark (’, U+2019) to terminate the path and inject a secondary command separated by a semicolon. The final character in the filename is typically a comment delimiter (#) to discard any residual syntax added by rclone.

file’; calc; #.txt

When the victim runs a verification command like rclone hash md5 sftp:dir/, the utility generates the following remote execution command:

Get-FileHash 'dir/file’; calc; #.txt' -Algorithm MD5

When the command string reaches the remote host, PowerShell parses it sequentially. The parser treats the segment 'dir/file’ as a complete, single-quoted string because the smart quote terminates the string started by the ASCII apostrophe. The semicolon (;) is evaluated as a statement separator, and the secondary command calc is executed immediately. The trailing hash character (#) instructs the parser to ignore the rest of the command, suppressing syntax errors that would otherwise prevent execution.

The successful exploitation of CVE-2026-71312 leads directly to arbitrary command execution on the target Windows system. The impact of this command execution depends on the configuration of the remote SSH server and the access control permissions of the user account running the SFTP daemon. In standard configurations, commands are executed with the security privileges of the logged-in SSH user.

If the SSH session runs under an administrative context, the attacker can achieve complete compromise of the system. This allows for arbitrary file deletion, modification of system binaries, installation of persistent backdoors, and lateral movement within the network. Even in lower-privileged contexts, an attacker can access sensitive local resources, read confidential files accessible to that user account, and disrupt service availability.

The CVSS v3.1 score is calculated as 8.0 (High Severity) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The attack vector is classified as Network, as the initial vector is delivered via a remote file upload. Attack complexity is Low since there are no specialized conditions or random variables in the parsing mechanism. Privileges Required is Low because any valid user account with write access to the SFTP share can plant the malicious file name. User Interaction is Required because the payload remains inert until an administrative or automated tool executes a server-side hashing command.

The primary remediation path is upgrading the rclone client to version 1.75.0 or later. This update modifies the command-building engine to escape the complete set of five PowerShell-compatible single-quote characters, neutralizing any breakout attempts at the client level.

If upgrading rclone is not immediately possible, administrators can apply several server-side workarounds to mitigate the risk:

• Change Remote Default Shell: Reconfigure the SSH server on the remote Windows host to use standard Command Prompt (cmd.exe) or a bash-compatible shell instead of PowerShell as the default shell for interactive commands.
• Disable Server-Side Hash Operations: Avoid executing commands such as rclone hash, rclone check, or rclone sync with server-side hashing flags against untrusted Windows-based SFTP remotes.
• Input Validation on SFTP Server: Implement file-name filters or sanitization policies directly on the SFTP server software to block the creation or upload of filenames containing non-ASCII Unicode characters, especially those in the U+2018 to U+201B range.

For detection, security teams should look for process creation events (Windows Security Event ID 4688) or PowerShell command logs (Event ID 4104) containing unusual path arguments. Suspicious patterns include command lines referencing Get-FileHash or file execution paths that combine Unicode smart quotes with command separators (;, &, |) and comment characters (#). Additionally, monitor for child processes of the SSH service spawning shell environments to run administrative binaries or external network tools.