/Vulnerability Library

RClone RC - Command Injection

CVE-2026-41179
Verified

Description

Rclone >= 1.48.0 and < 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment without global HTTP authentication.

Severity

Critical

CVSS Score

9.2

Exploit Probability

9%

Affected Product

rclone

Published Date

April 23, 2026

Template Author

theamanrawat

CVE-2026-41179.yaml
9.2Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE ID:
cve-2026-41179
CWE ID:
cwe-78

References

https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6qhttps://nvd.nist.gov/vuln/detail/CVE-2026-41179

Remediation Steps

Update to version 1.73.5 or later.