Rclone FTP CRLF Injection Vulnerability (CVE-2026-7111) Analysis

Vulnerability Overview Vulnerability Name: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines CVE ID: CVE-2026-7111 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: High Description: This vulnerability allows an attacker to recover original CRLF (Carriage Return Line Feed) sequences through FTP filename encoding, prior to the insertion of the attacker-controlled path into the line-oriented FTP control channel. The dependency does not reject CR or LF characters within command arguments; therefore, filenames can be injected as independent authentication commands. Default FTP encoding and configuration wizard examples include CRLF and are not restricted by the creation of "trusted" filenames. Manual custom encoding that omits CRLF is mandatory and is reflected in the high attack complexity. Scope of Impact Affected Versions: v1.74.0-240 Fixed Versions: v1.75.0 Affected Assets and Attack Surface: Verified rcclone revision: (v1.74.0-240: 649-c610f9138) Current main branch check: Related patch was on commit on 2026-07-18 rcclone FTP encoding: Encoder mask transformation: FTP command receiver: Dependency: Dependency command formatting: , with path-bearing callers at , and Prerequisites: The attacker must be able to create filenames in the source namespace, which the victim copies to an FTP destination with higher privileges, and the destination uses manually configured encoding that preserves original CRLF sequences. Platform notes: Unix and certain remote backends may provide names containing newlines; local Windows sources cannot create demonstration filenames. Remediation Technical Root Cause Analysis: Rclone internally represents control characters securely via standard encoding. Before FTP operations, decodes the representation and applies the configured backend mask. If the mask omits CRLF, the original newline characters are restored. The dependency subsequently formats the resulting arguments into CRLF-delimited control streams via without validation. Reversible filename representation is therefore used as the sole protection for protocol command boundaries. Proof of Concept and Evidence: Source filename equivalent to: With default encoding, no original newlines reach the command. With a valid non-default configuration , restores the original CRLF. In a real FTP operation, the server parses as an independent command. This establishes injection, rather than unreliable serialization. Tests did not establish impacts on confidentiality or operating system command execution. Impact Assessment: Injected commands run with the privileges of the configured FTP account. The demonstrated direct impact is the deletion of files in different paths, sharing the same confidentiality and integrity boundaries as the source namespace. Other FTP filesystem commands may be accessible, but confidentiality and arbitrary OS command execution are not claimed. Privilege boundary cases require the victim's FTP account to have higher privileges than the attacker possesses in the source namespace. Remediation Guidance: Reject CR and LF characters at the lowest command construction boundary for each FTP command argument. Apply checks to paths, usernames, passwords, rename parameters, and other formatted fields. Return an error instead of attempting to normalize unsafe parameters. Maintain the default encoder protection as part of defense in depth and reject FTP encoding configurations that can restore CRLF. Add end-to-end tests to verify handling of CR, LF, CRLF, and each path command. PoC Code:

Goal Reached Thanks to every supporter — we hit 100%!

Rclone FTP CRLF Injection Vulnerability (CVE-2026-7111) Analysis

More from this source