CVE-2026-71309: rclone: Incomplete path validation allows backend root escape in serve restic

rclone serve restic does not correctly reject URL paths beginning with ../. On affected backends, an attacker who can access the REST endpoint can read, create, overwrite, or delete objects outside the path configured by the operator.

The issue affects rclone v1.40 through rclone v1.74.4. The proof of concept and backend matrix were validated with the official Linux AMD64 binary for v1.74.4, and the latest master commit reviewed at the time (2217d38) contained the same vulnerable validation. The main proof of concept uses WsgiDAV as an independent storage server and one rclone process.