https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:00:12 +0000 https://cve.radiocsirt.org/vuln/bit-rclone-2026-54572 <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.</p> <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.</p> https://cve.radiocsirt.org/vuln/bit-rclone-2026-54572 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1125 certfr-2026-avi-1125 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1125 https://cve.radiocsirt.org/vuln/euvd-2026-337862 EUVD-2026-337862 https://cve.radiocsirt.org/vuln/euvd-2026-337862 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54572 <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54572 https://cve.radiocsirt.org/vuln/ghsa-cf44-9pgv-m4xc <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary With `-l/--links`, rclone serializes symlinks as `&lt;name&gt;.rclonelink` text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with `os.Symlink(&lt;object body&gt;, &lt;dest path&gt;)` and performs NO validation of the target. If the source is attacker-controlled, the attacker sets the body to any absolute or `../` path, so rclone plants a symlink inside the destination that points anywhere on the victim&#39;s filesystem. Because a sibling object named `&lt;name&gt;.rclonelink` sorts before `&lt;name&gt;/...`, rclone creates the escaping symlink first and then writes a following object &#34;inside&#34; it; `mkdirAll`/`OpenFile` follow the planted symlink, so the file lands OUTSIDE the destination with attacker-chosen contents. This yields arbitrary file write as the victim user, e.g. overwriting `~/.ssh/authorized_keys`, `~/.bashrc`, or a crontab — i.e. code execution.</p> <p>### Details `backend/local/local.go`, `Object.Update()`: ```go } else { out = nopWriterCloser{&amp;symlinkData} // body of &lt;name&gt;.rclonelink = attacker data } ... if o.translatedLink { if err == nil { if _, err := os.Lstat(o.path); err == nil { os.Remove(o.path) } // Use the contents for the copied object to create a symlink err = os.Symlink(symlinkData.String(), o.path) // &lt;-- target NEVER validated (abs / .. allowed) } } ``` `symlinkData` is the raw body of the source object, fully attacker-controlled…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary With `-l/--links`, rclone serializes symlinks as `&lt;name&gt;.rclonelink` text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with `os.Symlink(&lt;object body&gt;, &lt;dest path&gt;)` and performs NO validation of the target. If the source is attacker-controlled, the attacker sets the body to any absolute or `../` path, so rclone plants a symlink inside the destination that points anywhere on the victim&#39;s filesystem. Because a sibling object named `&lt;name&gt;.rclonelink` sorts before `&lt;name&gt;/...`, rclone creates the escaping symlink first and then writes a following object &#34;inside&#34; it; `mkdirAll`/`OpenFile` follow the planted symlink, so the file lands OUTSIDE the destination with attacker-chosen contents. This yields arbitrary file write as the victim user, e.g. overwriting `~/.ssh/authorized_keys`, `~/.bashrc`, or a crontab — i.e. code execution.</p> <p>### Details `backend/local/local.go`, `Object.Update()`: ```go } else { out = nopWriterCloser{&amp;symlinkData} // body of &lt;name&gt;.rclonelink = attacker data } ... if o.translatedLink { if err == nil { if _, err := os.Lstat(o.path); err == nil { os.Remove(o.path) } // Use the contents for the copied object to create a symlink err = os.Symlink(symlinkData.String(), o.path) // &lt;-- target NEVER validated (abs / .. allowed) } } ``` `symlinkData` is the raw body of the source object, fully attacker-controlled…</p> https://cve.radiocsirt.org/vuln/ghsa-cf44-9pgv-m4xc https://cve.radiocsirt.org/vuln/opensuse-su-2026:11241-1 <p>rclone-1.74.4-1.1 on GA media</p> <p>rclone-1.74.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11241-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54572 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54572 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2266 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebige Dateien zu lesen und zu schreiben, sowie Informationen offenzulegen und Sicherheitsmechanismen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebige Dateien zu lesen und zu schreiben, sowie Informationen offenzulegen und Sicherheitsmechanismen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2266