CVE-2026-54572 Details
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
A vulnerability in Rclone prior to version 1.74.4 allows for arbitrary file writes through unvalidated symlink targets when using the '--links' option. Rclone recreates symlinks as '.rclonelink' text objects and writes them to local destinations without validating the target. This flaw enables an attacker to plant a symlink pointing outside the intended directory, which can then be exploited to overwrite sensitive files, such as SSH keys or shell configuration files, leading to potential code execution.
Users can update to Rclone version 1.74.4 or later, where this vulnerability has been fixed. The update is available on the Rclone GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/rclone/rclone/commit/1154afebee986180b489084d38e2a0c578751498 | [email protected] | Patch |
| https://github.com/rclone/rclone/commit/874a804f5289517defdd7de68b2a374837080265 | [email protected] | Patch |
| https://github.com/rclone/rclone/releases/tag/v1.74.4 | [email protected] | Release Notes |
| https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rclone rclone | < 1.74.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |