Link following in rclone - CVE-2026-88016
Published: September 7, 2026 / Updated: September 12, 2026
Vulnerability details
The vulnerability allows a remote user to modify permissions, ownership, or timestamps of arbitrary files or directories outside the backup destination.
The vulnerability exists due to improper link resolution in rclone's local backend directory metadata handling when applying directory metadata to a destination path that is a planted symbolic link. A remote user can provide source contents that cause a symbolic link and attacker-controlled directory metadata to be processed to modify permissions, ownership, or timestamps of arbitrary paths outside the backup destination.
User interaction is required to run rclone copy or sync with --links against an untrusted source. Timestamp changes occur with --links, while permission and ownership changes additionally require --metadata.