Upstream information

CVE-2026-93986 at MITRE

Description

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

SUSE information

Overall state of this security issue: Revisit

This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.

CVSS v3 Scores
CVSS detail CNA (VulnCheck) SUSE
Base Score 3.1 3.1
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector Network Network
Attack Complexity High High
Privileges Required None None
User Interaction Required Required
Scope Unchanged Unchanged
Confidentiality Impact None None
Integrity Impact Low Low
Availability Impact None None
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
CVSS detail CNA (VulnCheck) SUSE
Base Score 2.3 2.3
Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Attack Vector Network Network
Attack Complexity High High
Attack Requirements Present Present
Privileges Required None None
User Interaction Passive Passive
Vulnerable System Confidentiality Impact None None
Vulnerable System Integrity Impact Low Low
Vulnerable System Availability Impact None None
Subsequent System Confidentiality Impact None None
Subsequent System Integrity Impact None None
Subsequent System Availability Impact None None
CVSSv4 Version 4.0 4.0
SUSE Bugzilla entry: 1282313 [NEW]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Tue Sep 22 20:07:05 2026
CVE page last modified: Wed Sep 23 21:56:46 2026