https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 13:10:17 +0000 https://db.gcve.eu/vuln/cve-2026-71312 <p><strong>Affected:</strong> rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.</p> <p><strong>Affected:</strong> rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though PowerShell treats U+2018, U+2019, U+201A, and U+201B as single-quote delimiters, allowing an attacker-controlled filename to terminate the intended path literal and append PowerShell statements that execute as the victim SSH account when server-side hashing is invoked. This issue is fixed in v1.75.0.</p> https://db.gcve.eu/vuln/cve-2026-71312 https://db.gcve.eu/vuln/ghsa-2m8m-jhrm-w6j2 <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## 1. Summary</p> <p>rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim&#39;s SSH account.</p> <p>## 2. Affected Assets &amp; Attack Surface</p> <p>- Audited commit: `a0c09f1381ae93e2a9a33c529d170186c61ad058` - Backend: `backend/sftp` - Relevant code: - `backend/sftp/sftp.go:1802-1812` — PowerShell hash commands - `backend/sftp/sftp.go:1663-1699` — `Fs.run` - `backend/sftp/sftp.go:1988-2067` — `Object.Hash` - `backend/sftp/sftp.go:2071-2090` — `quoteOrEscapeShellPath` - Exposed input: remote filename controlled by an SFTP collaborator, upstream storage source, or other party able to create or rename files. - Required execution context: PowerShell as the SSH command shell, SSH exec enabled, and server-side hashing invoked.</p> <p>## 3. Technical Root Cause Analysis</p> <p>For PowerShell, `quoteOrEscapeShellPath` wraps a path in ASCII apostrophes and doubles only `U+0027`:</p> <p>```go return &#34;&#39;&#34; + strings.ReplaceAll(shellPath, &#34;&#39;&#34;, &#34;&#39;&#39;&#34;) + &#34;&#39;&#34;, nil ```</p> <p>Windows PowerShell also treats `U+2018`, `U+2019`, `U+201A`, and `U+201B` as single-quote delimiters. Those characters pass through the rclone encoder and can close the quoted path. The completed string is sent as shell source through an SSH exec request.</p> <p>The security boundary f…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## 1. Summary</p> <p>rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim&#39;s SSH account.</p> <p>## 2. Affected Assets &amp; Attack Surface</p> <p>- Audited commit: `a0c09f1381ae93e2a9a33c529d170186c61ad058` - Backend: `backend/sftp` - Relevant code: - `backend/sftp/sftp.go:1802-1812` — PowerShell hash commands - `backend/sftp/sftp.go:1663-1699` — `Fs.run` - `backend/sftp/sftp.go:1988-2067` — `Object.Hash` - `backend/sftp/sftp.go:2071-2090` — `quoteOrEscapeShellPath` - Exposed input: remote filename controlled by an SFTP collaborator, upstream storage source, or other party able to create or rename files. - Required execution context: PowerShell as the SSH command shell, SSH exec enabled, and server-side hashing invoked.</p> <p>## 3. Technical Root Cause Analysis</p> <p>For PowerShell, `quoteOrEscapeShellPath` wraps a path in ASCII apostrophes and doubles only `U+0027`:</p> <p>```go return &#34;&#39;&#34; + strings.ReplaceAll(shellPath, &#34;&#39;&#34;, &#34;&#39;&#39;&#34;) + &#34;&#39;&#34;, nil ```</p> <p>Windows PowerShell also treats `U+2018`, `U+2019`, `U+201A`, and `U+201B` as single-quote delimiters. Those characters pass through the rclone encoder and can close the quoted path. The completed string is sent as shell source through an SSH exec request.</p> <p>The security boundary f…</p> https://db.gcve.eu/vuln/ghsa-2m8m-jhrm-w6j2