CVE-2026-88046: Directory Traversal and Root Confinement Escape in rclone Core Engine

CVE-2026-88046 is a critical directory traversal vulnerability residing in the core transfer engine of rclone, an open-source command-line tool used to sync and manage files across multiple cloud storage platforms. The flaw affects rclone's core listing, walking, and transfer logic in versions prior to 1.75.1.

In standard hierarchical filesystems, directory traversal sequences are blocked during file creation. However, flat-keyspace object stores allow arbitrary characters, including relative path sequences, within object keys. rclone failed to sanitize these relative path sequences before passing them to destination backends during synchronization or copy operations.

The root cause of the vulnerability lies in the lack of path sanitization on source paths returned by Object.Remote() in flat-keyspace storage providers like Amazon S3 or Backblaze B2. Because object storage keys are treated as simple strings, an attacker can write keys containing raw relative path segments like ../.

During a transfer operation, rclone's synchronization core queries the source backend and retrieves these unsanitized paths. The core then passes the malicious paths directly to destination backends without verification. The target backend resolves the destination location by joining the destination root directory with the malicious remote path using functions such as Go's path.Join.

Because path.Join automatically cleans relative directory markers, it collapses the traversal sequences, resolving the target file path outside the intended destination directory. If the destination credentials have adequate permissions, rclone writes the file to the traversed location, enabling arbitrary file write capabilities.

Prior to version 1.75.1, rclone did not inspect Object.Remote() paths for root directory escape sequences. To resolve this, the maintainers implemented a secure confinement validation function in fs/list/list.go named RemoteEscapesRoot.

func RemoteEscapesRoot(remote string) bool {
    const sentinel = "\\x00rootsentinel"
    joined := path.Join(sentinel, remote)
    return joined != sentinel && !strings.HasPrefix(joined, sentinel+"/")
}

This function prepends a sentinel string to the remote path and joins them. If the resulting path does not maintain the sentinel prefix, it signifies that the remote path escaped the root directory boundary.

// Before the patch, listings were returned directly without sanitization
// After the patch, listings are filtered in-place using RemoveEscaping
func RemoveEscaping(entries fs.DirEntries) fs.DirEntries {
    kept := entries[:0]
    for _, entry := range entries {
        if RemoteEscapesRoot(entry.Remote()) {
            fs.Errorf(entry, "Entry %q escapes the root - ignoring", entry.Remote())
            continue
        }
        kept = append(kept, entry)
    }
    return kept
}

This filter is integrated into standard directory listings, recursive walks, and metadata retrieval structures to block unauthorized path resolution.

Exploitation requires two main conditions: a malicious flat-keyspace storage source and user interaction to initiate a synchronization process targeting an affected backend. An attacker first uploads a file with a traversal key (e.g., ../../etc/cron.d/exploit) to a controlled object storage bucket.

When the victim executes rclone sync or rclone copy from the attacker-controlled source to a sensitive path-based destination (like SFTP or SMB), rclone processes the directory listing. The core resolves the target destination using the malicious relative path, resulting in arbitrary file writes outside the configured root directory.

If the destination backend is an SFTP server or a local file system, and the active session has administrative privileges, this traversal can overwrite system configuration files, leading to unauthorized modification of critical system parameters or remote code execution.

The impact of CVE-2026-88046 is classified as High Integrity impact with a CVSS v3.1 score of 5.3 (Medium severity) due to the necessity of user interaction and high attack complexity. Although the vulnerability requires a user to run a synchronization operation against a malicious source, the security implications are significant if triggered.

Successful exploitation results in arbitrary file write capabilities on destination hosts. Attackers can leverage this to overwrite system binaries, authorized keys, or cron jobs, which can lead to full host compromise under the security context of the running process. The vulnerability presents no direct confidentiality or availability impact on its own, but serves as a primary vector for privilege escalation and remote code execution.

The primary and most effective remediation is upgrading rclone to version 1.75.1 or later. The patch introduces centralized validation that automatically rejects any remote object paths containing directory traversal patterns.

If upgrading immediately is not possible, organizations should implement the following temporary mitigations:

• Avoid executing rclone synchronization operations against untrusted, public, or multi-tenant cloud storage buckets.
• Limit execution permissions of the rclone binary and the service accounts used for synchronization to prevent write access to critical operating system directories.
• Audit existing buckets for keys containing relative path directory sequences (e.g., .. or ../) and remove them immediately.