CyberRota Analysis
AI-GeneratedRclone serve S3 versions prior to 1.74.4 are vulnerable to a path traversal flaw that enables attackers to read and overwrite files at the root level by exploiting dot-dot segments in S3 object keys. This vulnerability poses a risk of unauthorized access to sensitive files, which could lead to data exposure or manipulation. Organizations using affected versions of rclone should prioritize upgrading to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.