Rclone CVE-2026-54572

Exploitation requires the victim to run rclone with the -l/--links flag (or backend links=true, i.e. TranslateSymlinks enabled) while copying/syncing TO a local destination FROM a remote whose contents the attacker controls or can influence. The attacker must be able to place two objects on that remote: an escaping symlink object ('<name>.rclonelink' whose body is a path outside the destination) and a follow-on object that sorts after it so it is written through the planted link. Limiting factors: --links is not a default option, so environments that never enable symlink translation are unaffected; the attack needs user-initiated interaction (UI:R) and control of the source remote's contents; it does not require any authentication on or prior access to the victim's local machine.

Signals are broadly consistent and point to a real but conditional risk rather than a mass-exploitation event. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L, base 8.8) reflects network-sourced malicious content, low complexity, no authentication on the target, but mandatory user interaction (the victim must initiate a sync with --links from an attacker-influenced remote) and a scope change (writes escape the destination root). SSVC aligns: exploitation is only 'poc', Automatable is 'no' (it needs a victim-initiated sync and attacker control of remote contents), and Technical Impact is 'partial'. EPSS is low at 0.34% (26th percentile) and the CVE is not in CISA KEV, so this is best treated as a plausible targeted-abuse primitive, not a wormable/widespread threat. The main caveat: exploitation is entirely gated on the non-default --links/-l option and on the victim treating an untrusted remote as a sync source - real-world exposure is much narrower than the 8.8 score alone suggests.

An attacker who controls or can influence a remote that a victim later restores with rclone -l/--links seeds a 'pwn.rclonelink' object whose body points outside the destination (e.g. to ~/.ssh) plus a sibling object such as 'pwn/authkeys' that sorts after it. When the victim runs the sync to a local target, unpatched rclone recreates the symlink and then writes the sibling object through it, landing attacker-chosen contents outside the intended directory. A working proof-of-concept mirroring this exact write-through is included in the advisory's test (TestSymlinkEscapeWriteThroughBlocked), so exploitation is demonstrated but requires the victim to initiate the sync with --links.