Rclone CVE-2026-116195

Requires all of: a local destination backend; the sync invoked with --links/-l (or --local-links) AND --metadata together; the default local encoding (no custom/Raw encoding needed, unlike the parent advisory); and an attacker able to create a directory named '...rclonelink' at the top of the source tree being copied (a shared upload or web root, another local user's area under /home or /srv, an untrusted archive/USB/network mount, or a malicious remote). Limiting factors defenders should weigh: the operator must actively run the sync with that exact flag combination (user interaction); the escape is metadata-only - content writes remain blocked by the os.Root hardening (GHSA-cf44-9pgv-m4xc); the escape depth is exactly one directory level ('<root>/..'); ownership change occurs only when rclone runs as root, while a non-root run is limited to rewriting timestamps and extended attributes outside the destination; and the mode/lchmod sink is unreachable on Linux (applies only where haveLChmod is true).

This is a genuine but conditional, moderate-priority issue rather than a drop-everything emergency. The supplied CVSS 4.0 vector (7.0) carries AC:H, AT:P and UI:P, signalling that exploitation is gated by a specific flag combination and operator action rather than a clean drive-by. No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of mass or active exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), which fits a serious flaw that is not yet weaponised at scale. The GHSA advisory from the reporter (VulnCheck) contains a detailed, measured reproduction, so a public PoC reference exists even though it is not packaged as a standalone working exploit. One signal to treat with care: the CVSS vector is AV:N (PR:N, unauthenticated), yet the primary described attack is planting a directory in a locally-synced source tree, which in practice requires local write access to that source (shared upload area, another local user's path, untrusted mount) - the network vector realistically applies only when the synced source is a malicious remote. Net: real impact (ownership/metadata control over the destination's parent, a privilege-escalation primitive when rclone runs as root), but narrow preconditions and no confirmed in-the-wild use point to targeted rather than widespread risk - patch promptly this week, prioritising root-run backup/sync jobs.

On a root-run backup job, an attacker who can write into the tree being synced (e.g. a home directory under /home, a multi-tenant upload area, or an untrusted archive/USB/network mount) creates a directory named '...rclonelink' at the top of that tree. When the operator runs 'rclone sync ... --links --metadata' as root, the '.rclonelink' suffix is trimmed after the containment check, so the path resolves to the parent of the destination root and rclone applies attacker-controlled ownership and timestamps to it, yielding rename/replace control over the destination tree. The GHSA advisory includes a measured proof-of-concept reproduction (as uid 0, go1.26.5).