HIGH 7.0 NVD
CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
References
- https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827
- https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink
This high severity vulnerability with a CVSS score of 7.0 was published on 2026-10-25 via NVD.
vulnfeed aggregates 17091 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.