CVE-2026-54572
Description
A flaw was found in Rclone, a command-line program for syncing files with cloud storage. When handling symbolic links (symlinks) with the -l or --links option, Rclone serializes them as text objects and recreates them without proper validation. A remote attacker could exploit this by providing a malicious symlink, allowing subsequent file writes to occur outside the intended destination with content chosen by the attacker. This could lead to unauthorized modification of files on the system.
Statement
Rclone's -l/--links option serializes symbolic links encountered during a sync as .rclonelink text objects containing the link target, and later recreates those links on the destination. Prior to 1.74.4, rclone did not validate that a stored link target stays within the intended destination tree before recreating it. A remote storage backend under an attacker's control can therefore supply a crafted .rclonelink object whose target escapes the destination directory (e.g. via a ../ traversal or an absolute path), causing a subsequent write during the same or a later sync to be redirected outside the intended destination with attacker-chosen content.
Exploitation requires that the victim explicitly enable symlink handling (-l/--links) and initiate a sync against a remote the attacker can influence (e.g. a shared/untrusted cloud storage bucket, or a compromised legitimate remote); it is not exploitable against a default rclone configuration or against a fully trusted remote. This combination of required non-default configuration and required user-initiated action from an untrusted source is reflected in Red Hat's CVSS vector (AC:H, UI:R). The confidentiality impact is limited to what can be inferred from being able to overwrite files (e.g. tampering with a config file that is later read), while the primary impact is to integrity (arbitrary attacker-controlled file content written outside the sync destination) and, secondarily, availability (overwriting or corrupting files outside the destination).
This issue is corrected upstream in rclone 1.74.4, which validates a .rclonelink target stays within the destination before recreating it.
Mitigation
Upgrade to rclone 1.74.4 or later, which validates symlink targets before recreating them and rejects links that would escape the destination directory.
If an immediate upgrade is not possible, mitigate by avoiding the vulnerable code path:
do not use the -l/--links command-line option when syncing to or from a remote that is not fully trusted, since this is what enables rclone to serialize and recreate symlinks in the first place.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
