Affected: rclone

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root directory.

Affected: Go: github.com/rclone/rclone

### Summary

rclone serve s3 allows a client to read and write files at the root of the remote which would normally be inaccessible by using dot-dot path segments in the object key. It does not allow reading files outside of the root. A request such as GET /bucket/../root-secret.txt is handled as an object request for bucket "bucket", but rclone normalizes the backend path and reads root-secret.txt from the serve root. The same issue also allows overwriting root-level files with PUT.

### Details

The affected component is rclone serve s3.

Relevant source files:

cmd/serve/s3/backend.go cmd/serve/s3/multipart.go cmd/serve/s3/list.go

In cmd/serve/s3/backend.go, the S3 backend builds backend paths by joining the bucket name and object key with path.Join:

fp := path.Join(bucketName, objectName)

This pattern is used in object operations such as HeadObject, GetObject, PutObject, DeleteObject, and CopyObject.

S3 object keys are opaque names and can legally contain dot-dot segments. However, path.Join treats the object key as a filesystem-style path and normalizes ../ segments. As a result, an object key such as ../root-secret.txt is resolved outside the selected bucket directory.

For example, when rclone serve s3 is serving a root directory that contains:

root/ bucket/ root-secret.txt

a raw S3 HTTP request to:

GET /bucket/../root-secret.txt

is parsed as a request for bucket "bucket" and object "../root-secret.txt". The backend then calculates:

path.Join("bucket", ".…