CVE-2026-88016: rclone directory metadata escape through symlink in --links mode

CVE-2026-88016 · Severity: high · CVSS 7.1 · Published 2026-09-10

rclone is a file synchronization tool that copies data between local and cloud storage. When the `--links` and `--metadata` flags are used together with an untrusted remote source, an attacker can plant symlinks that point outside the destination directory, then apply file permission and ownership changes (chmod/chown) through those symlinks to arbitrary paths outside the backup target—potentially affecting system files or sensitive directories the backup user has permission to modify.

Technologies: github.com/rclone/rclone (Go), Rclone. Vendors: Go, Rclone.

Quick answers

Is CVE-2026-88016 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88016 being exploited in the wild.
How severe is CVE-2026-88016?
High severity, with a CVSS score of 7.1, published 10 September 2026.
Which products and versions are affected?
github.com/rclone/rclone (Go) <= 1.75.0, SEMVER:introduced=0,fixed=1.75.1; Rclone <= 1.75.0.
Is there a fix for CVE-2026-88016?
Yes. github.com/rclone/rclone (Go): upgrade to 1.75.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88016 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88016?
Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/rclone/rclone (Go): upgrade to 1.75.1 or later
    go get github.com/rclone/rclone@v1.75.1

Technical details

The vulnerability exploits a logic gap in rclone's directory metadata handling (MkdirMetadata function). When `--links` is used, rclone recreates `.rclonelink` objects as real symlinks verbatim at the destination—by design for faithful backups. However, the subsequent directory metadata application (chmod/chown/chtimes via writeMetadataToFile and setTimes) does not use symlink-safe syscalls (NOFOLLOW) and does not route through the os.Root sandbox. When os.Lstat succeeds on a pre-existing planted symlink, the code skips the guarded os.Root.Mkdir branch and instead directly applies raw os.Chown, os.Chmod, and os.Chtimes syscalls on the symlink path, which follow the symlink to the target outside the destination. The NOFOLLOW protection introduced for CVE-2024-52522 is gated on the `translatedLink` flag, which is never set for Directory objects. An attacker controlling the source can serve a `.rclonelink` file pointing to an external path, then in a subsequent sync operation present that same path as a real directory with chosen metadata (mode, uid, gid, mtime), causing rclone to apply those values to the external target through the planted symlink. Successful exploitation requires `--links` (for symlink planting); `chmod`/`chown` escape additionally requires `--metadata`. If rclone runs as root with `--metadata` and a source uid=0, the attacker gains privilege-escalation primitives.

Affected products

  • rclone rclone <= 1.75.0

Identifiers

  • CVE-2026-88016
  • GHSA-f8g7-2xjc-7mfh
  • GO-2026-6459

Timeline

  • 2026-09-04: disclosed
  • 2026-09-10: advisory
  • 2026-09-04: patched: Fix released in v1.75.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.