Executive brief
rclone, a popular command-line tool for managing files on cloud storage, is vulnerable to a security flaw when using the '--links' feature. An attacker who controls a remote storage location can trick rclone into creating malicious shortcuts (symlinks) on a user's computer. This allows the attacker to overwrite sensitive system files, potentially leading to full unauthorized access or control over the victim's machine.
Technical details
A vulnerability exists in rclone's local backend (backend/local/local.go) within the Object.Update() function. When the -l/--links flag is used, rclone serializes symlinks as .rclonelink files but fails to validate the link target when recreating them at the destination. An attacker controlling a remote source can provide a symlink target containing absolute paths or directory traversal sequences (../). Because rclone processes these objects in a specific order and follows existing symlinks during subsequent file writes without using O_NOFOLLOW, it can be coerced into writing files outside the intended destination directory. This can result in arbitrary file overwrite and remote code execution if sensitive files like ~/.ssh/authorized_keys are targeted. The issue is fixed in version 1.74.4.
Affected products
- rclone rclone <= 1.74.3
Timeline
- 2026-07-08: disclosed
- 2026-07-14: advisory: NVD publication date
- 2026-08-05: patched: GitHub Advisory published/updated date