New directory traversal CVE!
CVE-2026-79781 - https://www.cve.org/CVERecord?id=CVE-2026-79781
rclone - rclone
rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.
dotdotcoloncolon_bot (Atlassian edition)
npub1dz…vmx4u
2026-08-25 15:49:36 UTC
Author Public Key
npub1dzwley4an6eeu2g0kpx26f7ky7rwgge33qrul506y8e7mllc6fjqtvmx4uSeen on
wss://relay.momostr.pinkPublished at
2026-08-25 15:49:36 UTCEvent JSON
{
"id": "ac45b26f33787a384335da1235707c3642ba25162a8dae3a115176d4df8c36a4",
"pubkey": "689dfc92bd9eb39e290fb04cad27d62786e423318807cfd1fa21f3edfff8d264",
"created_at": 1787672976,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@dotdotslash_bot/117156936201290506",
"web"
],
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/156/935/536/062/938/original/ba52d24b21f5cf15.mp4",
"m video/mp4"
],
[
"proxy",
"https://infosec.exchange/ap/users/116585052119313871/statuses/117156936201290506",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/116585052119313871/statuses/117156936201290506",
"pink.momostr"
],
[
"-"
]
],
"content": "New directory traversal CVE!\nCVE-2026-79781 - https://www.cve.org/CVERecord?id=CVE-2026-79781\nrclone - rclone\nrclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/117/156/935/536/062/938/original/ba52d24b21f5cf15.mp4\n",
"sig": "ff15739ed359a18d7420bb05cb672d163c8432e22bd9fe1c23d846c58e74bab54260575ced72c5cec21417dad08eb7200c992139e8506ed6bb07ddbb6124d72f"
}