CVE-2026-116191: Path traversal in Rclone serve webdav

Rclone is a widely used tool among system administrators and IT teams for synchronizing and backing up data to cloud services and file servers. CVE-2026-116191 affects the serve webdav module in Rclone versions prior to 1.75.2 and stems from insufficient validation of path components. An unauthenticated attacker can send webdav requests containing '..' sequences to write above the served directory root, compromising data isolation for other tenants in multi-tenant environments.

The vulnerability has a CVSS score of 7.5 (High) and was published by NVD on October 25, 2026. Its status is confirmed: the NVD technical description provides specific details about the attack mechanism (MKCOL, PUT, MOVE, COPY) and affected versions. A further signal of community awareness comes from public GitHub repositories that provide detectors to identify Rclone versions exposed to this flaw.

The priority actions for defenders are twofold: first, inventory all systems using Rclone in serve webdav mode and verify their version; instances prior to 1.75.2 must be updated without delay. Second, for already exposed environments, audit the served file system to identify files created, modified, or deleted without authorization, particularly in multi-tenant contexts where data isolation is critical. Suspending the webdav service until the patch is applied is advisable if residual risk is not tolerable.