EUVD-2026-44532
GHSA-cf44-9pgv-m4xc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
Malicious remote content (AV:N/PR:N) needs a victim-run --links sync (UI:R) and escapes the destination root (S:C); primary impact is attacker-controlled writes outside the target (I:H), with no direct read (C:N) and limited availability effect (A:L).
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Primary rating from Vendor (github).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
AnalysisAI
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local sync destination when a victim runs a copy/sync with the -l/--links flag. Rclone stores symlinks as .rclonelink text objects and recreates them on the local target without validating the link target, so a malicious remote can plant an escaping symlink and have a subsequent object write land outside the chosen destination with attacker-chosen contents. Publicly available exploit code exists (GHSA PoC), but there is no evidence of active exploitation and EPSS is low (0.34%).
Technical ContextAI
Rclone is a widely used Go command-line tool for syncing files to and from cloud storage and local filesystems. The flaw sits in the local backend (backend/local/local.go): when translation of symlinks is enabled (-l/--links, internally FollowSymlinks=false / TranslateSymlinks=true), a symlink is represented as a small text object named '<name>.rclonelink' whose body is the link target. On write, rclone recreated the symlink and performed follow-on file writes using ordinary path operations (os.Symlink, file.OpenFile, file.MkdirAll) that follow existing symlinks. This is a classic CWE-59 link-following / link-resolution-before-file-access issue: because the destination path could itself traverse a symlink planted earlier in the same sync, writes were redirected outside the intended root. The fix routes all symlink-mode directory creation, file opens, and symlink creation through Go's os.Root API (osRoot/mkdirAll/openFile/symlink helpers), which refuses to traverse a planted symlink out of the anchored destination while still recreating the link verbatim for faithful backups.
RemediationAI
Vendor-released patch: upgrade to rclone 1.74.4 or later, which routes all --links-mode filesystem operations through os.Root so planted symlinks can no longer be traversed out of the destination (fix commits 1154afebee986180b489084d38e2a0c578751498 and 874a804f5289517defdd7de68b2a374837080265; advisory GHSA-cf44-9pgv-m4xc). If you cannot upgrade immediately, the most effective compensating control is to stop using the -l/--links (and backend links=true) option when syncing from any remote you do not fully trust, since exploitation is impossible without symlink translation - the trade-off is that symlinks will no longer be backed up or restored. Additionally, only sync to local destinations from trusted sources, run rclone under a low-privilege account and constrain its filesystem permissions so an escaping write cannot reach sensitive paths (e.g. SSH authorized_keys, cron, config), and inspect remotes for unexpected .rclonelink objects before performing a --links restore.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impers
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenti
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to appl
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key seg
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote att
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or hos
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today