Affected: rclone

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.

Affected: Go: github.com/rclone/rclone

## 1. Summary

rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim's SSH account.

## 2. Affected Assets & Attack Surface

- Audited commit: `a0c09f1381ae93e2a9a33c529d170186c61ad058` - Backend: `backend/sftp` - Relevant code: - `backend/sftp/sftp.go:1802-1812` — PowerShell hash commands - `backend/sftp/sftp.go:1663-1699` — `Fs.run` - `backend/sftp/sftp.go:1988-2067` — `Object.Hash` - `backend/sftp/sftp.go:2071-2090` — `quoteOrEscapeShellPath` - Exposed input: remote filename controlled by an SFTP collaborator, upstream storage source, or other party able to create or rename files. - Required execution context: PowerShell as the SSH command shell, SSH exec enabled, and server-side hashing invoked.

## 3. Technical Root Cause Analysis

For PowerShell, `quoteOrEscapeShellPath` wraps a path in ASCII apostrophes and doubles only `U+0027`:

```go return "'" + strings.ReplaceAll(shellPath, "'", "''") + "'", nil ```

Windows PowerShell also treats `U+2018`, `U+2019`, `U+201A`, and `U+201B` as single-quote delimiters. Those characters pass through the rclone encoder and can close the quoted path. The completed string is sent as shell source through an SSH exec request.

The security boundary f…