CVE-2026-116195: Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Q: What conditions are required for exploitation?

An attacker must be able to plant a directory named ...rclonelink in a source tree that will be synchronized. The affected sync must use both --links and --metadata.

Q: What can an attacker change outside the intended destination?

Successful exploitation can change ownership, timestamps, and extended attributes of the destination directory’s parent directory. The issue results from suffix trimming after the destination containment check.

Q: Which deployments are exposed?

Rclone versions before 1.75.2 are affected when using the local backend with --links and --metadata. The provided information does not indicate that default configurations are affected.

Published Oct 25, 2026

Updated

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.

Affected Software

1 affected component

Rclone Rclone<1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Rclone to a version that resolves this vulnerability.
Fixed in 1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to plant a directory named ...rclonelink in a source tree that will be synchronized. The affected sync must use both --links and --metadata.

What can an attacker change outside the intended destination?

Successful exploitation can change ownership, timestamps, and extended attributes of the destination directory’s parent directory. The issue results from suffix trimming after the destination containment check.

Which deployments are exposed?

Rclone versions before 1.75.2 are affected when using the local backend with --links and --metadata. The provided information does not indicate that default configurations are affected.

CVE-2026-116195: Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What can an attacker change outside the intended destination?

Which deployments are exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What can an attacker change outside the intended destination?

Which deployments are exposed?