Executive brief
rclone is a file synchronization tool that copies data between local and cloud storage. When the `--links` and `--metadata` flags are used together with an untrusted remote source, an attacker can plant symlinks that point outside the destination directory, then apply file permission and ownership changes (chmod/chown) through those symlinks to arbitrary paths outside the backup target—potentially affecting system files or sensitive directories the backup user has permission to modify.
Technical details
The vulnerability exploits a logic gap in rclone's directory metadata handling (MkdirMetadata function). When `--links` is used, rclone recreates `.rclonelink` objects as real symlinks verbatim at the destination—by design for faithful backups. However, the subsequent directory metadata application (chmod/chown/chtimes via writeMetadataToFile and setTimes) does not use symlink-safe syscalls (NOFOLLOW) and does not route through the os.Root sandbox. When os.Lstat succeeds on a pre-existing planted symlink, the code skips the guarded os.Root.Mkdir branch and instead directly applies raw os.Chown, os.Chmod, and os.Chtimes syscalls on the symlink path, which follow the symlink to the target outside the destination. The NOFOLLOW protection introduced for CVE-2024-52522 is gated on the `translatedLink` flag, which is never set for Directory objects. An attacker controlling the source can serve a `.rclonelink` file pointing to an external path, then in a subsequent sync operation present that same path as a real directory with chosen metadata (mode, uid, gid, mtime), causing rclone to apply those values to the external target through the planted symlink. Successful exploitation requires `--links` (for symlink planting); `chmod`/`chown` escape additionally requires `--metadata`. If rclone runs as root with `--metadata` and a source uid=0, the attacker gains privilege-escalation primitives.
Affected products
- rclone rclone <= 1.75.0
Timeline
- 2026-09-04: disclosed
- 2026-09-10: advisory
- 2026-09-04: patched: Fix released in v1.75.1