What is GHSA-4fcc-gp7q-gf9r?

GHSA-4fcc-gp7q-gf9r is a security advisory published by GitHub Security Advisories with High severity. Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows...

Which CVE IDs does GHSA-4fcc-gp7q-gf9r cover?

GHSA-4fcc-gp7q-gf9r covers the following CVE IDs: CVE-2026-116191. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4fcc-gp7q-gf9r?

GHSA-4fcc-gp7q-gf9r has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-4fcc-gp7q-gf9rHighCVSS 7.5

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-116191 →

📋 Description

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

🔗 References (4)

https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63
https://nvd.nist.gov/vuln/detail/CVE-2026-116191
https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-serve-webdav-mkcol
https://github.com/advisories/GHSA-4fcc-gp7q-gf9r