HIGH 8.8 GitHub
CVE-2026-59733
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
## Summary
`rclone serve restic --private-repos` exists to let one rclone instance host many users' restic backup repositories behind HTTP Basic auth while keeping each user confined to a path prefix of `/<username>/`. The documentation states the flag "can be used to limit users to repositories starting with a path of `/<username>/`", and the shipped test `TestResticPrivateRepositories` asserts that user `test` may reach `/test/config` but is `403`-blocked from `/other_user/config`. This isola
Affected Products
- go/github.com/rclone/rclone <= 1.74.3
References
- https://github.com/advisories/GHSA-fqj9-69pf-6pjg
- https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg
- https://nvd.nist.gov/vuln/detail/CVE-2026-59733
- https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-08-05 via GitHub. Affected: go/github.com/rclone/rclone <= 1.74.3.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.