Path traversal in rclone - CVE-2026-116195
Published: November 4, 2026
Vulnerability identifier: #VU159318
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116195
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify metadata of the destination root's parent directory and potentially escalate privileges when rclone runs as root.
The vulnerability exists due to path traversal in rclone's local backend when translateLink removes the .rclonelink suffix from an operating-system path after its containment check. A remote attacker can plant a directory named ...rclonelink at the top of a source tree and induce an operator to copy it, causing the validated path to become the destination root followed by /.. and redirecting metadata updates to its parent directory.
Affected software
rclone
How to mitigate CVE-2026-116195
Install security update from vendor's website.
rclone - update to 1.75.2