Live › vulnerability › CVE-2026-116195
Go to dashboardRclone before 1.75.2 trims the .rclonelink suffix from paths after its containment check in the local backend's translateLink function, so a crafted name can resolve outside the destination root. An attacker who plants a directory named ...rclonelink in a source tree can change the ownership, timestamps and xattrs of the destination's parent directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone with the local backend as a destination and enable both --links and --metadata are exposed, and the risk comes from the source tree content being synced. Installs that do not use those flags, or that only sync trusted sources, can skip it.
No product ranges from the sources yet.
rclone version and check whether it reports a version earlier than 1.75.2.--links and --metadata against local destinations, for example in cron entries or CI configs.1.75.2 or later.--links with --metadata on source trees you do not trust.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116195")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.