Executive brief
rclone is a file-sync and storage utility that can read archived file formats including SquashFS disk images stored in cloud storage. Versions 1.72.0 through 1.74.4 fail to validate malicious SquashFS metadata, allowing an attacker who places a crafted archive in accessible storage to crash rclone processes or SFTP servers, or consume persistent CPU resources when the archive is accessed.
Technical details
The vulnerability exists in rclone's archive backend which delegates SquashFS parsing to the github.com/diskfs/go-diskfs library. Three distinct input validation flaws were identified: (1) division by zero when superblock block_size is zero, (2) out-of-bounds slice access when inode metadata offset exceeds block length, and (3) infinite non-progressing loop when metadata stream is truncated. Variants 1 and 2 trigger unhandled panics that crash the rclone process; when invoked via 'rclone serve sftp', they crash the entire SFTP server. Variant 3 causes sustained CPU consumption without panic. Attack requires the ability to place or modify a SquashFS image in storage exposed via rclone's :archive: remote, and a victim or remote client must address or descend into the malicious object to trigger parsing. The vulnerability is fixed in rclone v1.75.0.
Affected products
- rclone rclone >=1.72.0, <=1.74.4
Timeline
- 2026-07-31: disclosed
- 2026-07-31: patched: fix released in v1.75.0