CVE-2026-116191

{
  "etk_id": "ETK-2026-2600",
  "cve_id": "CVE-2026-116191",
  "display_id": "CVE-2026-116191",
  "ghsa_id": "GHSA-44pm-2q5p-fm63",
  "euvd_id": "EUVD-2026-109449",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in rclone WebDAV server",
  "summary": "Rclone versions before 1.75.2 running the WebDAV server are affected. An unauthenticated remote client may create, replace, or remove files outside the intended served directory if it can reach that service.",
  "mitigation": "Upgrade rclone to version 1.75.2 or later. Until upgraded, restrict WebDAV server access to trusted clients and networks.",
  "vendor": "rclone",
  "product": "rclone",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.75.1"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.75.2"
      ],
      "package_name": "github.com/rclone/rclone",
      "purl": "pkg:golang/github.com/rclone/rclone"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.3899226,
  "t0_at": "2026-10-25T13:20:26.490000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-25T13:20:26.490000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-25T13:20:26.490000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116191"
    }
  }
}