Technical impact
Rclone, a command-line tool for synchronizing data to and from cloud storage, previously recreated symbolic links on a local destination without verifying their target. If an attacker can supply a file that contains a malicious symlink—such as by uploading a crafted item to a cloud bucket that rclone reads—rclone will emit the file at the link’s target location on disk. This results in an arbitrary file write outside the intended destination, giving the attacker the ability to modify critical files or inject malicious code. The weakness corresponds to CWE‑59, unsafe file handling based on untrusted input.
Affected Systems
All installations of rclone that run a version earlier than 1.74.4 and use the --links (‑l) option are affected. Any user who has a locally running rclone instance fetching data from a remote cloud provider could be impacted if the remote source includes a malicious symlink. The fix is applied in version 1.74.4, so any older version remains vulnerable.
Risk and Exploitability
The CVSS base score of 7.5 signals a high‑impact flaw, while the EPSS score of less than 1 % indicates that the probability of exploitation is currently low and the vulnerability does not appear in CISA’s KEV catalogue. The likely attack vector involves an attacker‑controlled remote storage that rclone; with minimal privileges on the local host, rclone will write the target file outside the designated directory, providing a straightforward path to privilege escalation or further compromise.
Github GHSA