Description

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name` field of a Docker VolumeDriver.Create request without verifying that the result stays within drv.root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file.MkdirAll before mounting. A volume name containing enough `..` components (e.g. "../../../../../../etc") therefore resolves outside the base directory, allowing anyone able to submit a VolumeDriver.Create request to the plugin socket — normally the Docker daemon, or a workload that can request named volumes in a multi-tenant orchestration setup — to make the privileged rclone plugin process create a directory and mount a remote filesystem specified in the same request at an arbitrary host path, shadowing or disrupting system directories. The advisory notes Volume.restoreState() had the same missing validation when reloading persisted volume state. Fixed in 1.75.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.4",
  "pubDate": "2026-09-19T12:16:42.187Z",
  "pubdate": "2026-09-19T12:16:42.187Z",
  "executiveSummary": "Rclone versions 1.56.0 through 1.75.0 are affected by a path traversal vulnerability within the 'rclone serve docker' volume plugin. This vulnerability stems from improper validation of the 'name' field in Docker VolumeDriver.Create requests, allowing attackers to escape the intended base directory.\nThe vulnerability allows an attacker to influence the creation and mounting of remote filesystems at arbitrary locations on the host filesystem. By providing a crafted payload containing directory traversal sequences (e.g., '..'), an attacker can cause the rclone plugin process—which often runs with elevated privileges—to perform unauthorized file system operations.\nThe impact is significant, potentially leading to system directory shadowing, service disruption, or unauthorized access to sensitive host data. Exploitation is possible for any entity capable of submitting a VolumeDriver.Create request to the plugin socket. This is particularly relevant in multi-tenant orchestration environments where workload isolation may be compromised. The vulnerability also exists in the 'Volume.restoreState()' function, which fails to validate persisted volume state during reload. Users are advised to upgrade to version 1.75.1 immediately to remediate this issue.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of user-supplied volume names within the 'rclone serve docker' plugin. Specifically, in 'cmd/serve/docker/volume.go', the 'newVolume()' function calculates the destination mountpoint by concatenating a base directory ('drv.root') with an attacker-controlled 'name' string using 'filepath.Join()'. Because the 'name' field is not sanitized to remove or validate path traversal sequences like '../', the resulting path can resolve to locations outside the intended '/var/lib/docker-volumes/rclone' directory.\nThe exploitation flow begins when an attacker sends a 'VolumeDriver.Create' request to the plugin socket with a malicious 'name' parameter. For example, by specifying a name like '../../../../../../etc', the application resolves the path to an arbitrary directory on the host. Following the resolution, the 'checkMountpoint()' function utilizes 'os.MkdirAll' to create the directory at the traversed path. Subsequently, the plugin mounts a remote filesystem—defined within the same request—onto this arbitrary location.\nThe vulnerability is compounded by a similar lack of validation in 'Volume.restoreState()'. When the plugin reloads persisted volume state from disk, it performs the same flawed resolution logic, potentially allowing for the exploitation of existing configurations or malicious state files injected into the persistence layer.\nThis flaw grants the attacker control over where the rclone plugin mounts external storage. By mounting a remote resource over a critical system directory or an application configuration path, an attacker can effectively shadow existing files. This can lead to the subversion of system security controls, the injection of malicious binaries or configurations, or the persistent denial of service of system components dependent on those directories.\nThe attack requires the ability to communicate with the Docker volume plugin socket. While typically restricted to the Docker daemon, in multi-tenant environments where users or workloads have authorization to request named volumes, this interface becomes an entry point for escalation. The plugin, operating with elevated system privileges to perform mounts, becomes the execution vector for the unauthorized file system modifications. No specific network exposure is required if the attacker is already inside a container or process capable of reaching the plugin's Unix domain socket."
}