BIT-rclone-2026-54572

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-54572.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-rclone-2026-54572
Aliases
Published
2026-07-19T23:51:44.432Z
Modified
2026-07-20T08:41:43.886131835Z
Summary
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
Details

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / rclone

Package

Name
rclone
Purl
pkg:bitnami/rclone

Severity

  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.74.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-54572.json"