Rclone: Path traversal in serve webdav allows writes outside served root

Summary

Rclone before 1.75.2 contains a path traversal flaw in its serve webdav feature. An unauthenticated remote attacker can send MKCOL /.. to plant a node above the served directory and then create, overwrite, move, copy or delete files there, including files belonging to other tenants sharing the same backend. The attack needs only two HTTP requests and is rated High (CVSS 4.0: 8.7) with an integrity impact.

Affected

• rclone serve webdav, all versions before 1.75.2
• The first affected version is unknown; do not assume which 1.7x releases are unaffected.

Fixed in

• Upgrade to rclone 1.75.2 or later (released 9 October 2026).
• Distribution packages may lag behind; use the upstream binary or a package confirmed to include the fix.

Workaround

• No vendor workaround is documented.
• Until patched, do not expose serve webdav to the internet or to untrusted networks; restrict access with a firewall or VPN.
• Do not use serve webdav for shared or multi-tenant storage.
• Unknown: whether enabling authentication blocks exploitation. Do not rely on it as a mitigation until confirmed.

Exploitation

• Not listed in CISA KEV; no confirmed known exploitation.
• CISA SSVC: exploitation none, automatable yes.
• HackerWire lists no public PoC. Vulners lists an unverified GitHub entry titled 'Exploit for CVE-2026-116191'.
• A Nuclei detection template exists, so vulnerable hosts can be found easily by scanners.

Our recommendation

• Identify all hosts running rclone serve webdav, starting with systems reachable from untrusted networks.
• Upgrade to rclone 1.75.2 or later and verify the installed version.
• Until patched, remove public exposure and restrict access by firewall or VPN.
• Check served directories and the storage behind them for unexpected, modified or missing files, and review access logs for MKCOL requests containing '..'.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  asvorg/CVE-2026-116191-poc

Research sources

• GitHub Security Advisory GHSA-44pm-2q5p-fm63 github.com
• VulnCheck advisory: Rclone before 1.75.2 Path Traversal via serve webdav MKCOL www.vulncheck.com
• OSV entry BIT-rclone-2026-116191 osv.dev
• Ubuntu Security Notice CVE-2026-116191 ubuntu.com
• rclone 1.75.2 release announcement (forum) forum.rclone.org
• rclone releases github.com
• Nuclei detection template pull request github.com
• HackerWire: CVE-2026-116191 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:16.