CVE-2026-116195GHSA-55qp-jrwr-x827
Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
rclone rclone
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.75.2rcloneCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
Text from CVE List
Affected versions 2
- rcloneaffected: all versions before 1.75.2CVE List
- rcloneunaffected: 1.75.2CVE List