rclone Versions Below 1.73.5 Critical Security Vulnerabilities

CERT-Bund published a security advisory reporting critical vulnerabilities in rclone, an open-source command-line file synchronization tool for cloud storage services. Multiple flaws allow an attacker to bypass security mechanisms and execute arbitrary code, with a CVSS Base Score of 9.8 and a CVSS Temporal Score of 8.8. The affected version is Open Source rclone prior to 1.73.5, covering Linux, UNIX, Windows, and other operating systems.

Organisations using rclone for cloud storage synchronization should prioritise updating to version 1.73.5 or later. Given the critical severity and confirmed remote attack vector, any deployment with network-accessible rclone instances faces elevated risk. While the advisory indicates mitigation is available, no specific compensating controls are detailed beyond the version update.