Advisory severityMedium6.4Red Hat Linux

Medium [CVE-2026-71311] FTP command injection via CRLF in filename encoding

This medium-severity Red Hat Linux advisory covers CVE-2026-71311.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-71311 Source published Aug 5, 2026Source updated Aug 5, 2026

VulniPulse record published Aug 6, 2026Record updated Aug 11, 2026

CVE-2026-71311

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

FTP command injection via CRLF in filename encoding. Red Hat rates this moderate (CVSS 6.4).

Weakness: CWE-93.

Affected versions

< 1.75.0

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

1.75.0

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To mitigate this issue, avoid configuring `rclone` FTP backends with non-default filename encodings that allow raw carriage return or line feed characters. If such a configuration is unavoidable, ensure that all filenames processed by `rclone` from untrusted sources are validated to prevent the injection of arbitrary FTP commands. Additionally, restrict the privileges of the FTP destination to minimize the impact of any potential command injection.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.