CVE-2026-93987 - rclone serve docker Path Traversal via Volume Name
Brief
CVE ID : CVE-2026-93987
Published : Sept. 19, 2026, 12:16 p. m.
- 4 hours, 40 minutes ago
Description : rclone versions 1.
- 0 through 1.
- 0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume. go computes a volume's mountpoint as filepath. Join(drv. root, name) from the attacker-supplied `name` field of a Docker VolumeDriver. Create request without verifying that the result stays within drv.
root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file. MkdirAll before mounting. A volume name containing enough `.. ` components (e. g. " /.. /.. /.. /.. /.. /etc") therefore resolves outside the base directory, allowing anyone able to submit a VolumeDriver.