CVE-2026-71312: rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone interpolates remote SFTP paths into PowerShell hash commands. Its quoting helper escapes only ASCII apostrophe, although PowerShell accepts four Unicode smart quotes as single-quote delimiters. An attacker-controlled filename can therefore terminate the intended path literal and append PowerShell statements executed as the victim’s SSH account.