Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1275

NIXPKGS-2026-1275
published 4 months, 2 weeks ago
Permalink CVE-2026-41179
updated 4 months, 2 weeks ago by @LeSuisse Activity log
  • Created suggestion 4 months, 2 weeks ago
  • @LeSuisse ignored
    9 packages
    • librclone
    • rclone-ui
    • syncrclone
    • rclone-browser
    • git-annex-remote-rclone
    • gnomeExtensions.rclone-manager
    • python312Packages.rclone-python
    • python313Packages.rclone-python
    • python314Packages.rclone-python
    4 months, 2 weeks ago
  • @LeSuisse accepted 4 months, 2 weeks ago
  • @LeSuisse published on GitHub 4 months, 2 weeks ago
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Affected products

rclone
  • ==>= 1.48.0, < 1.73.5

Matching in nixpkgs

pkgs.rclone

Command line program to sync files and directories to and from major cloud storage

Ignored packages (9)

pkgs.rclone-ui

Cross-platform desktop GUI for rclone & S3

pkgs.gnomeExtensions.rclone-manager

Imagine a Dropbox sync client but with support for over 30 cloud services, all accessible right from your top panel. This tool allows you to manage, monitor, and perform essential operations on your rclone profiles, making remote storage management a breeze. Mount remotes, monitor file changes, sync seamlessly, and navigate your storage, all in one place. Stay updated with real-time status displays for each profile and easily access event logs for a complete view of your activity. Plus, with backup and restore capabilities for your rclone configuration file, setting up multiple devices has never been simpler. Everything while keeping your data private. Unlike other programs from private companies, this tool respects your privacy, sending no information anywhere.

  • nixos-unstable 17
    • nixpkgs-unstable 17
    • nixos-unstable-small 17

Package maintainers