8.8

CVE-2026-54572

Exploit

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rclone ≫ Rclone Version < 1.74.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.31% 0.231
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
security-advisories@github.com 7.5 1.6 5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc
Vendor Advisory
Exploit
Mitigation
https://github.com/rclone/rclone/commit/1154afebee986180b489084d38e2a0c578751498
Patch
https://github.com/rclone/rclone/commit/874a804f5289517defdd7de68b2a374837080265
Patch
https://github.com/rclone/rclone/releases/tag/v1.74.4
Release Notes