CVE-2026-116195

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Published Oct 25, 2026 CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Description

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.

Analysis

Technical impact

Rclone prior to 1.75.2 contains a path traversal flaw in the local backend's translateLink function that trims the .rclonelink suffix after a containment check. This allows an attacker to craft a directory named …rclonelink in a source tree that is synced with the --links and --metadata options, causing files to resolve outside the intended destination root and enabling unauthorized changes to the destination's parent directory ownership, timestamps, and extended attributes.

Affected Systems

Vendors and products affected are rclone, specifically all releases before version 1.75.2. Users of rclone 1.75.1 or earlier who use the local backend with --links and --metadata are at risk.

Risk and Exploitability

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score is not available, and the flaw is not listed in CISA KEV, suggesting no widespread exploits have been reported. However, exploitation requires an attacker to supply a specially crafted source tree containing a …rclonelink directory and to run rclone with --links and --metadata, which many users perform when syncing data. Successful exploitation could lead to privilege escalation by altering ownership and metadata of parent directories within the destination.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rclone

unaffected

Version	Status	Constraints
`0`	affected	< 1.75.2
`1.75.2`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Rclone

Version	Status	Scheme	Platform
`[0,1.75.2)`	affected	semver	—
`1.75.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade rclone to version 1.75.2 or later.
Rename or delete any directories named …rclonelink in source trees before running rclone sync with --links or --metadata.
Limit rclone execution to non‑privileged users and avoid using the --links and --metadata options unless necessary.

Generated by OpenCVE AI on October 25, 2026 at 16:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.229% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827
https://nvd.nist.gov/vuln/detail/CVE-2026-116195
https://www.cve.org/CVERecord?id=CVE-2026-116195
https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink-rclonelink-suffix-trim

History

Oct 26, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116195 https://www.cve.org/CVERecord?id=CVE-2026-116195
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.
Title		Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
First Time appeared		Rclone Rclone rclone
Weaknesses		CWE-22
CPEs		cpe:2.3:a:rclone:rclone::::::::
Vendors & Products		Rclone Rclone rclone
References		https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827 https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink-rclonelink-suffix-trim
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N'}` cvssV4_0 `{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N'}`