How many CVEs have a located fix in rclone/rclone?

19 published CVEs have a fix traced to functions in rclone/rclone, touching 78 functions across 33 files.

Which function in rclone/rclone has been patched by the most CVEs?

writeMetadataToFile in backend/local/metadata.go has been changed by 2 CVE fixes, from 2024 to 2026.

How large is a typical CVE fix in rclone/rclone?

The median fix changes 46 lines. 42% of fixes change 20 lines or fewer, and 26% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

#281 of 500 repositories

rclone/rclone

Name: rclone/rclone: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 10, 2026

19

CVE fixes located

Published CVEs

78

Functions patched

Distinct function sites

33

Files patched

Distinct source files

2024–2026

Years covered

By CVE publication date

Overview

19 published CVEs have a fix traced to functions in rclone/rclone, the earliest published in 2024. Those fixes changed 78 distinct functions across 33 files, in 269 patch hunks.

Among the 500 repositories tracked here, rclone/rclone ranks #281 by the number of CVEs with a located fix.

Most patched functions

Functions in rclone/rclone changed by the most CVE fixes.

Most patched files

Files in rclone/rclone changed by the most CVE fixes.

1backend/local/local.go4 CVEs · 17 functions
2cmd/serve/proxy/proxy.go2 CVEs · 7 functions
3cmd/serve/s3/server.go2 CVEs · 6 functions
4cmd/serve/ftp/ftp.go2 CVEs · 5 functions
5backend/local/metadata.go2 CVEs · 1 functions
6cmd/serve/restic/restic.go2 CVEs · 1 functions
7cmd/serve/sftp/server.go1 CVEs · 4 functions
8cmd/serve/webdav/webdav.go1 CVEs · 4 functions
9backend/http/http.go1 CVEs · 3 functions
10cmd/serve/http/http.go1 CVEs · 3 functions

Fix size

How much code a CVE fix in rclone/rclone changes, with backports counted once.

46

Median lines changed

Added plus removed, per CVE

42%

Fixes of 20 lines or fewer

Share of CVE fixes

26%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in rclone/rclone, and the functions each fix changed.

rclone: source object names can escape the configured root on upload
CVE-2026-88046RemoteEscapesRoot StatJSON bool
Medium · CVSS 5.3
EPSS 0.3%2026-09-10
rclone: S3 multipart declared-length memory exhaustion
CVE-2026-88045UploadPart
High · CVSS 7.5
EPSS 0.6%2026-09-10
rclone: RC per-server auth-proxy bypass
CVE-2026-88044Shutdown newServer getVFS
Critical · CVSS 9.1
EPSS 0.5%2026-09-10
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
CVE-2026-88018authPairMiddleware CallAccessKey Proxy
Critical · CVSS 9.8
EPSS 0.5%2026-09-10
rclone: FTP cross-session auth-proxy backend confusion
CVE-2026-88017main driver CheckPasswd
High · CVSS 7.3
EPSS 0.2%2026-09-10
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
CVE-2026-88016chmod writeMetadataToFile setTimes
High · CVSS 7.1
EPSS 0.2%2026-09-10
rclone local: crafted Range request against a translated symlink panics (DoS)
CVE-2026-88015openTranslatedLink
Medium · CVSS 5.3
EPSS 0.4%2026-09-10
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
CVE-2026-88014readZip
Medium · CVSS 6.3
EPSS 0.2%2026-09-10
rclone: http backend forwards custom/auth headers to a different host on redirect
CVE-2026-88013checkRedirect SameHost redirectLeavesHost
Medium · CVSS 5.3
EPSS 0.2%2026-09-10
rclone: Local Encoding Path Traversal
CVE-2026-71313localPath newObject DirMove
Medium · CVSS 6.9
EPSS 0.3%2026-08-05
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
CVE-2026-71312Hash
High · CVSS 8.0
EPSS 0.5%2026-08-05
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
CVE-2026-71311commandEncoding NewFs
Medium · CVSS 6.4
EPSS 0.4%2026-08-05

Get an alert for each new rclone/rclone CVE, with the patched functions and AI-written analysis.

Monitor rclone CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

1Panel-dev/MaxKB19 CVEs alextselegidis/easyappointments19 CVEs baserproject/basercms19 CVEs bookstackapp/bookstack19 CVEs cloudfoundry/uaa19 CVEs debian/dovecot19 CVEs debian/nginx19 CVEs debian/openimageio19 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in rclone/rclone.

How many CVEs have a located fix in rclone/rclone?: 19 published CVEs have a fix traced to functions in rclone/rclone, touching 78 functions across 33 files.
Which function in rclone/rclone has been patched by the most CVEs?: writeMetadataToFile in backend/local/metadata.go has been changed by 2 CVE fixes, from 2024 to 2026.
How large is a typical CVE fix in rclone/rclone?: The median fix changes 46 lines. 42% of fixes change 20 lines or fewer, and 26% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track rclone/rclone CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing