{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "rclone: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/rclone--rclone/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/rclone--rclone/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116191/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116191/",
   "title": "CVE-2026-116191 · rclone · disclosed",
   "content_text": "Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.",
   "date_published": "2026-10-25T13:20:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116189/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116189/",
   "title": "CVE-2026-116189 · rclone · disclosed",
   "content_text": "rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.",
   "date_published": "2026-10-25T13:20:25Z"
  }
 ]
}