CVE-2026-79783: rclone before 1.74.4 Privilege Escalation via setuid Metadata
rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when rclone runs with elevated privileges and copies from an untrusted remote using metadata preservation through the local backend. A successful attack can escalate to root when rclone runs as root, or to the account used by the rclone service otherwise.
What does an attacker need to exploit it?
The attacker needs control over source-supplied file mode metadata on an untrusted remote and must be able to have that content copied with metadata preservation enabled. They can use this to cause setuid or setgid bits to be applied to attacker-controlled files.
Are default rclone copies affected?
The provided information identifies copying with metadata preservation as the affected condition. It does not establish whether metadata preservation is enabled by default.
What version addresses the issue?
Upgrade to rclone 1.74.4 or later. Versions before 1.74.4 are affected according to the supplied advisory information.