CVE-2026-54572: Rclone Path Traversal Vulnerability

CVE-2026-54572 Overview

Rclone is a command-line utility that synchronizes files and directories across cloud storage providers. Versions prior to 1.74.4 contain a symlink handling flaw when the -l/--links flag is used. Rclone serializes symlinks as .rclonelink text objects and recreates them on the local destination without validating the symlink target. An attacker who controls a remote source can plant a symlink that escapes the destination directory. A subsequent object write then lands outside the intended destination with attacker-chosen contents, enabling arbitrary file write on the sync host. The issue is resolved in Rclone 1.74.4 and is tracked as [CWE-59] Improper Link Resolution Before File Access.

Critical Impact
Attacker-controlled remotes can write arbitrary files outside the sync destination, enabling code execution paths, configuration tampering, and privilege escalation on hosts running vulnerable Rclone versions.

Affected Products

Rclone versions prior to 1.74.4
Rclone deployments using the -l or --links flag with untrusted remotes
Automated sync jobs and backup pipelines that pull data from third-party cloud storage

Discovery Timeline

2026-07-14 - CVE-2026-54572 published to NVD
2026-07-17 - Last updated in NVD database
Rclone 1.74.4 - Fix released via commits 1154afeb and 874a804f

Technical Details for CVE-2026-54572

Vulnerability Analysis

Rclone represents symbolic links as text placeholder files with the .rclonelink suffix when transferring between backends that lack native symlink support. When syncing to a local filesystem with --links enabled, Rclone reads the .rclonelink content and reconstructs the symlink on disk. The vulnerable code path does not validate that the symlink target stays within the destination directory. An attacker who controls the remote source stages a .rclonelink file whose contents point to a path outside the destination, such as ../../../../etc/cron.d/exploit or a user configuration directory. Once the symlink is created, any following file write directed at that logical path follows the symlink and writes attacker-controlled content to a filesystem location the attacker chose.

Root Cause

The root cause is missing target validation during symlink materialization ([CWE-59]). Rclone trusts the string stored inside the .rclonelink object and calls the local symlink creation routine without normalizing the path, resolving it against the destination root, or rejecting traversal sequences. The subsequent write operation inherits the resolved path, converting a benign sync operation into an arbitrary file write primitive.

Attack Vector

Exploitation requires an attacker to control a source remote from which the victim syncs, and requires the victim to invoke Rclone with -l or --links. The attacker uploads a crafted .rclonelink object alongside a companion payload file. When the victim runs rclone sync or rclone copy, Rclone creates the escaping symlink first and then writes the payload through it. The write executes with the privileges of the Rclone process, which in scheduled backup or CI/CD contexts is often a service or root account.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-cf44-9pgv-m4xc for the maintainer's technical description.

Detection Methods for CVE-2026-54572

Indicators of Compromise

Unexpected .rclonelink files in remote source buckets or repositories, particularly those containing .. sequences or absolute paths in their body
Symlinks in Rclone destination directories whose targets resolve outside the destination root
File modifications to sensitive paths such as ~/.ssh/authorized_keys, /etc/cron.d/, or systemd unit directories immediately after a scheduled Rclone job

Detection Strategies

Audit Rclone command lines and cron entries for use of -l or --links against remotes that are not fully trusted
Inventory installed Rclone binaries across servers and workstations and flag any version earlier than 1.74.4
Scan sync destinations for symlinks whose readlink target contains path traversal characters or escapes the destination tree

Monitoring Recommendations

Enable filesystem audit rules (auditd, EDR file-integrity monitoring) on directories written to by Rclone service accounts
Alert on symlink() and symlinkat() syscalls issued by the Rclone process with targets outside the working directory
Correlate Rclone process execution telemetry with subsequent writes to sensitive system paths

How to Mitigate CVE-2026-54572

Immediate Actions Required

Upgrade Rclone to version 1.74.4 or later on every host that runs sync, copy, or mount operations
Review all automation that uses -l/--links and disable the flag where symlink replication is not strictly required
Rotate credentials and secrets that may have been exposed by any file overwritten through a compromised sync job

Patch Information

The fix ships in Rclone 1.74.4. The upstream commits 1154afeb and 874a804f validate symlink targets during local reconstruction and block writes that would escape the destination. Release notes and binaries are available on the GitHub Release v1.74.4 page and the GitHub Security Advisory GHSA-cf44-9pgv-m4xc.

Workarounds

Run Rclone without -l/--links so .rclonelink objects are ignored rather than materialized
Execute Rclone under a dedicated low-privilege user with a chroot or bind-mounted destination that cannot reach sensitive paths
Restrict sync sources to remotes under your administrative control until every host is patched to 1.74.4

bash

# Verify installed Rclone version and upgrade if below 1.74.4
rclone version | head -n 1

# Safer invocation pattern: omit --links against untrusted remotes
rclone sync remote:bucket /srv/backup \
  --config /etc/rclone/rclone.conf \
  --log-file /var/log/rclone.log \
  --log-level INFO