CVE-2026-71312— rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-71312
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
Source: CVE Program / CVE List V5
Vulnerability Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-71312
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Qwen3.6-35B-A3B · 11804 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-71312
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-71312 (1)
Vendor Advisories for CVE-2026-71312 (1)
Vendor Pages for CVE-2026-71312 (1)
- 🔗 Release rclone v1.75.0 · rclone/rclone · GitHubx_refsource_MISC
Same Patch Batch · rclone · 2026-08-05 · 5 CVEs total
| CVE-2026-71309 | 8.6 HIGH | rclone: Incomplete path validation allows backend root escape in serve restic |
| CVE-2026-71313 | 6.9 MEDIUM | rclone: Local Encoding Path Traversal |
| CVE-2026-71311 | 6.4 MEDIUM | rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newline |
| CVE-2026-71310 | 5.9 MEDIUM | rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory |
IV. Related Vulnerabilities
Same product: rclone
- CVE-2026-71313
rclone: Local Encoding Path Traversal - CVE-2026-71311
rclone: FTP Command Arguments Permit CRLF Injection When Cus - CVE-2026-71310
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust - CVE-2026-71309
rclone: Incomplete path validation allows backend root escap - CVE-2026-59733
rclone `serve restic --private-repos` authorization bypass:
Same vendor: rclone
- CVE-2026-71313
rclone: Local Encoding Path Traversal - CVE-2026-71311
rclone: FTP Command Arguments Permit CRLF Injection When Cus - CVE-2026-71310
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust - CVE-2026-71309
rclone: Incomplete path validation allows backend root escap - CVE-2026-59733
rclone `serve restic --private-repos` authorization bypass:
Same weakness: CWE-78
- CVE-2026-66297
Unescaped deployment environment variables in generated setu - CVE-2026-70611
Electron: DevTools embedder handler executes arbitrary files - CVE-2026-17625
Langflow is affected by OS Command Injection in Model Contex - CVE-2026-17623
Langflow is affected OS Command Injection in Model Context P - CVE-2026-13477
IBM QRadar SIEM is vulnerable to remote code execution by pr
V. Comments for CVE-2026-71312
No comments yet