BSD Portsrclone -- Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation
· CVE-2026-49980 · VuXML entry
https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv reports: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. …
Affected versions
- rclone >= 1.46.0 < 1.74.3
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/rclone | 1.69.3 | vulnerable since 2026-06-29 | |
| OpenBSD | sysutils/rclone | 1.75.2 | out of range, by version | |
| NetBSD | net/rclone | 1.75.1 | not listed | |
| MidnightBSD | net/rclone | 1.57.0 | in range, by version | |
| FreeBSD | net/rclone | 1.75.2_1 | fixed | (12 days after) |