GHSA-45pq-889g-fcgh: rclone: Incomplete path validation allows backend root escape in serve restic

Summary rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator. The issue affects rclone v1.40 through rclone v1.74.4. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for v1.74.4, and the latest master commit reviewed at the time (2217d38) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process. Affected versions All releases from v1.40 through v1.74.4 are affected. Affected components and backend propagation The primary vulnerable component is the backend-independent WithRemote middleware in cmd/serve/restic/restic.go, lines 235-264. It accepts a leading parent component and stores that unsafe relative path in the request context. The REST handlers then pass the same value to whichever rclone backend the operator configured. Therefore, the flaw is not specific to WebDAV. The backend determines whether the accepted ../ path escapes, is preserved, or is encoded as safe filename characters. The source locations and line numbers below correspond to the release used for dynamic testing: | Layer or backend | File and function | Relevant lines | Path propagation | Dynamic evidence | |---|---|---:|---|---| | REST server, primary cause | cmd/serve/restic/restic.go, WithRemote | 235-264 | Accepts a leading ../ remote and shares it with GET, HEAD, POST, and DELETE handlers | Confirmed through WebDAV | | WebDAV | backend/webdav/webdav.go, (*Fs).filePath | 421-427 | path.Join(f.root, file) removes the configured root when resolving ../ | read, write, delete | | FTP | backend/ftp/ftp.go, (*Fs).NewObject, (*Object).Open, Update, and Remove | 844-848, 1308-1311, 1349-1356, 1411-1415 | Each operation joins the backend root and remote with path.Join before the FTP request | re