High
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
Type: advisorySources: OSV
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-54572
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 19:09 UTC · Revision 1
Source evidence
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
core-osv · Original sourcePublished 14 Jul 2026, 21:37 UTC
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
osv:CVE-2026-54572
Complete source record
{
"id": "674c9c5559640a37897a1600c97b7ee64b4d5b0a7a9465b4f132fc6ae236a445",
"url": "https://osv.dev/vulnerability/CVE-2026-54572",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote",
"summary": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.",
"evidence": "osv:CVE-2026-54572",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-54572",
"aliases": [
"BIT-rclone-2026-54572",
"CVE-2026-54572",
"GHSA-cf44-9pgv-m4xc",
"GO-2026-6191"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rclone/rclone",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5bc93a2a7ab0ebd0a11352bc4968eabeffb18027"
},
{
"fixed": "1154afebee986180b489084d38e2a0c578751498"
},
{
"fixed": "874a804f5289517defdd7de68b2a374837080265"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.74.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "1154afebee986180b489084d38e2a0c578751498"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "874a804f5289517defdd7de68b2a374837080265"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "5bc93a2a7ab0ebd0a11352bc4968eabeffb18027"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.74.4"
}
]
}
}
],
"versions": [
"v1.74.3",
"v1.74.2",
"v1.74.1",
"v1.74.0",
"v1.73.0",
"v1.72.0",
"v1.71.0",
"v1.70.0",
"v1.69.0",
"v1.68.0",
"v1.67.0",
"v1.66.0",
"v1.65.0",
"v1.64.0",
"v1.63.0",
"v1.62.0",
"v1.61.0",
"v1.60.0",
"v1.59.0",
"v1.58.0",
"v1.57.0",
"v1.56.0",
"v1.55.0",
"v1.54.0",
"v1.53.0",
"v1.52.0",
"v1.51.0",
"v1.50.0",
"v1.49.0",
"v1.48.0",
"v1.47.0",
"v1.46.0",
"v1.46",
"v1.45",
"v1.44",
"v1.43",
"v1.42",
"v1.41",
"v1.40",
"v1.39",
"v1.38",
"v1.37",
"v1.36",
"v1.35",
"v1.34",
"v1.33",
"v1.32",
"v1.31",
"v1.30",
"v1.29-1-gbb75d80",
"v1.29",
"v1.28",
"v1.27",
"v1.26",
"v1.25",
"v1.24",
"v1.23",
"v1.22",
"v1.21",
"v1.20",
"v1.19",
"v1.18",
"v1.17",
"v1.16",
"v1.15",
"v1.14",
"v1.13",
"v1.12",
"v1.11",
"v1.10",
"v1.09",
"v1.08",
"v1.07",
"v1.06",
"v1.05",
"v1.04",
"v1.03",
"v1.01",
"v1.00",
"v0.99",
"v0.98",
"v0.97",
"v0.96",
"v0.95",
"v0.94",
"v0.93",
"v0.92",
"v0.91",
"v0.90"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54572.json"
}
}
],
"modified": "2026-10-28T02:30:48.128889183Z",
"provider": "osv",
"references": [
"https://github.com/rclone/rclone/releases/tag/v1.74.4",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54572.json",
"https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc",
"https://nvd.nist.gov/vuln/detail/CVE-2026-54572",
"https://github.com/rclone/rclone/commit/1154afebee986180b489084d38e2a0c578751498",
"https://github.com/rclone/rclone/commit/874a804f5289517defdd7de68b2a374837080265"
],
"provider_metadata": {
"cwe_ids": [
"CWE-59"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54572.json"
}
},
"related_cves": [
{
"value": "CVE-2026-54572",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 515946,
"published_at": "2026-07-14T21:37:41.882+00:00"
}