---
cve: "CVE-2026-71311"
severity: "MEDIUM"
cvss: 6.4
epss: "24%"
vendor: "rclone"
kev: false
exploited: false
published: "2026-08-05 21:16:58"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-11T18:42:33+02:00"
---

# CVE-2026-71311

> 6.4 MEDIUM · 🧪 PoC

## Beschreibung

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel, and github.com/jlaffaye/ftp formats the argument through textproto.Conn.Cmd without rejecting CR or LF, allowing a filename such as victim CRLF DELE other-secret CRLF NOOP to inject an independent authenticated FTP command when the victim copies or syncs to a more-privileged FTP destination. This issue is fixed in 1.75.0.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Gering | warn |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- 1df2b70753286c1dfe8366078cbedfdf7f96472c (Commit)
- 9ee9d0a0cafd5e5fe3b271d2280b090ab6e64048 (Commit)

## Referenzen

- <https://github.com/rclone/rclone/security/advisories/GHSA-8c48-q9wj-3w37>
- <https://github.com/rclone/rclone/commit/1df2b70753286c1dfe8366078cbedfdf7f96472c>
- <https://github.com/rclone/rclone/releases/tag/v1.75.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-71311) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_