BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

[SECURITY] Fedora 45 Update: rclone-1.75.0-2.fc45

"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Driv e, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azure Files, Yandex Files...

SUSE CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

SUSE CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

SUSE CVE-2026-88016

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

SUSE CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

SUSE CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

SUSE CVE-2026-88044

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

SUSE CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

CVE-2026-88045

A flaw was found in rclone. A remote attacker can exploit a memory exhaustion vulnerability in the S3 streamed multipart path. By manipulating the Content-Length or X-Amz-Decoded-Content-Length headers, an attacker can cause the application to reserve excessive memory without sending the declared...

CVE-2026-88013

A flaw was found in rclone. The HTTP backend in rclone can forward custom or authentication headers, such as API keys, Authorization, or Cookie headers, when following redirects to a different host. This can lead to the disclosure of sensitive information to untrusted destinations. Additionally, ...

CVE-2026-88046

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...

CVE-2026-88014

A flaw was found in rclone. This vulnerability, known as Zip Slip, allows a remote attacker to write arbitrary files outside of the intended destination when processing a specially crafted ZIP archive. By manipulating archive entry names, an attacker can bypass path sanitization, leading to...

CVE-2026-88017

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:23+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77 2026-09-11 11:09:30+00:00| seen| https://gist.github.com/alon710/bdeb340c6c170113e47b6e3cbfb5203b 2026-09-11 16:00:46+00:00|...

CVE-2026-88015

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:16+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw...

CVE-2026-88016

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:14+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh 2026-09-11 16:00:46+00:00| seen|...

CVE-2026-88014

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:12+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q...

Linux Distros Unpatched Vulnerability : CVE-2026-88014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend...

Linux Distros Unpatched Vulnerability : CVE-2026-88018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with...

Linux Distros Unpatched Vulnerability : CVE-2026-88044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC...