{"id":"GO-2026-6458","summary":"rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone","details":"rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone","aliases":["BIT-rclone-2026-88017","CVE-2026-88017","GHSA-c476-6w5q-jw77"],"modified":"2026-09-17T17:40:51.444163094Z","published":"2026-09-16T16:56:29Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6458","review_status":"UNREVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88017"},{"type":"FIX","url":"https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99"},{"type":"WEB","url":"https://github.com/rclone/rclone/releases/tag/v1.75.1"}],"affected":[{"package":{"name":"github.com/rclone/rclone","ecosystem":"Go","purl":"pkg:golang/github.com/rclone/rclone"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.64.0"},{"fixed":"1.75.1"}]}],"ecosystem_specific":{"imports":[{"symbols":["AddFlags","FileInfo.Group","FileInfo.ModTime","FileInfo.Owner","Logger.Print","Logger.PrintCommand","Logger.PrintResponse","Logger.Printf","driver.Addr","driver.ChangeDir","driver.CheckPasswd","driver.DeleteDir","driver.DeleteFile","driver.GetFile","driver.ListDir","driver.MakeDir","driver.PutFile","driver.Rename","driver.Serve","driver.Shutdown","driver.Stat","driver.getVFS","newServer"],"path":"github.com/rclone/rclone/cmd/serve/ftp"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6458.json"}}],"schema_version":"1.9.0"}