An authenticated path traversal vulnerability in rclone allows unauthorized file system access, requiring an immediate update to version 1.75.0 to secure file operations.

This vulnerability involves improper limitation of pathnames to a restricted directory (CWE-22), enabling an authenticated attacker to traverse the file system and access or modify files beyond the scope of the configured storage provider.

The CVSS score of 8.6 indicates a critical risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of sensitive configuration files, credentials, or other critical data stored on the system, potentially resulting in full system compromise.

Immediate Action: Upgrade rclone to version 1.75.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit rclone execution logs for unusual file access patterns or attempts to access system directories outside of the designated sync paths.

Compensating Controls: Enforce strict file system permissions for the user account running rclone to limit the impact if a traversal attempt occurs.

Public Exploit Available: Unknown

Given the availability of a proof-of-concept and the high severity of path traversal vulnerabilities, users must upgrade to version 1.75.0 without delay. Failure to patch leaves the underlying file system exposed to unauthorized manipulation by any authenticated user with access to the tool.