7.0
Élevée
CVE-2026-116195 Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which…
Description
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| rclone 1.75 | premières → < 1.75.2 | 1.75.2 |
Références
Chronologie
- Publiée
- Dernière modification
Autres CVE de rclone
Les 42 CVE de rclone →
CVE-2026-116196
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
6.0
Moyenne
CVE-2026-116194
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…
7.6
Élevée
CVE-2026-116193
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets…
6.9
Moyenne
CVE-2026-116192
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
8.2
Élevée