Technical impact
The vulnerability is in the self‑update feature of the rclone command‑line tool, where the checksum validation step trusts values that appear before the PGP‑clearsigned SHA256SUMS block. Because of this mismatch, an attacker who can control the distribution path can prepend a matching checksum line for a malicious archive. When the self‑update process runs, it will download and install the attacker‑controlled binary, giving the attacker full code execution privileges on the affected system. This flaw is a classic example of improper signature verification (CWE‑347).
Affected Systems
The affected product is the rclone application from the rclone project. Versions from 1.55.0 through 1.75.1 (inclusive) use the vulnerable self‑update logic. Any installation that relied on the stable self‑update mechanism during that window is susceptible.
Risk and Exploitability
The CVSS score of 7.7 signals a high severity issue. Exploitation requires the attacker to control the release distribution path to inject an unsigned checksum line, making it a supply‑chain attack rather than a plain network‑based exploit. The EPSS score is currently unavailable, and the vulnerability has not been listed in CISA's KEV catalog, but because it grants arbitrary code execution, the risk remains significant, especially in environments where rclone operates with elevated privileges.
