CVE-2026-116195

MEDIUM 6.1

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.

CWE	CWE-22
Vendor	rclone
Product	rclone
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for rclone rclone

Be the first to know when new medium vulnerabilities affecting rclone rclone are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

rclone / rclone

0 < 1.75.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827 vulncheck.com: https://www.vulncheck.com/advisories/rclone-before-1.75.2-path-traversal-via-translatelink-rclonelink-suffix-trim

Credits

🔍 kta1kri ncw