Advisory · CVE-2026-116191
rclone serve webdav path traversal lets unauthenticated clients write above the served root
rclone before 1.75.2 contains a path traversal vulnerability in serve webdav: an unauthenticated MKCOL request with a dot-dot path plants a node above the served root, after which PUT, MOVE, COPY, and MKCOL can create, overwrite, or delete files above the root, including files belonging to other tenants. CVSS 4.0 8.7.
- Vendor
- rclone
- Product
- rclone
- Identifier / CWE
- CVE-2026-116191
CWE-22 - Action timing
- Immediate
Explain it like I’m five
rclone serves one folder over WebDAV but forgets to check a request that names the folder above it, so a stranger can step one level up and start writing files there.
- 01WebDAV service exposed
An operator runs rclone serve webdav over a remote, with write access enabled.
- 02Escape node planted
An unauthenticated client sends MKCOL with a dot-dot path, planting a VFS node whose path resolves above the served root.
- 03Writes route upward
Follow-up PUT, MOVE, COPY, or MKCOL requests through that node are joined onto the backend root and resolve one level above the served directory.
- 04Files above the root change
The client creates or overwrites files above the root, including sibling directories and files belonging to other tenants, and can delete files it planted or overwrote.
What happened
rclone disclosed CVE-2026-116191 in its GitHub security advisory: serve webdav does not validate a dot-dot path component in MKCOL. The request plants a VFS directory node whose backend path is literally the parent, and from that moment every write routed through it resolves above the directory rclone was told to serve. The advisory demonstrates, with executed tests, creating and overwriting files above the root, writing into another tenant directory, and moving files out of the served tree, all unauthenticated in two requests.
Per the affected data in the NVD record, rclone versions before 1.75.2 are affected and 1.75.2 is the fixed version; the vendor advisory states it established the open range by running its probe against released binaries up to 1.75.1. The advisory also bounds the flaw: the escape is exactly one level, to the served directory parent; reading an untouched file above the root is refused in current versions; and running serve webdav with the read-only flag is, in the vendor words, a complete mitigation, checked rather than assumed.
What to do
- Inventory rclone serve webdav instances, including those fronting shared or multi-tenant remotes.
- Upgrade affected installs to rclone 1.75.2 or later using the project release guidance.
- Until upgraded, run serve webdav read-only where writes are not required, and restrict the service to trusted networks and authenticated, authorized users.
- Inspect the parent directory of every served root for unexpected new or overwritten files, directories, and moved content, including sibling tenant directories.
- Review WebDAV logs for MKCOL requests carrying dot-dot paths followed immediately by writes.
Management note
Serving one directory is a confinement promise, and this build breaks it by one level, which is exactly where sibling tenants and operator files tend to live. Upgrade, then look above every served root, not inside it.