Symlink Attack Affecting github.com/rclone/rclone/backend/local package, versions <1.74.4
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMRCLONERCLONEBACKENDLOCAL-18020606
- published20 Jul 2026
- disclosed15 Jul 2026
- creditNguyễn Tiến Thà nh
Introduced: 15 Jul 2026
CVE-2026-54572 Â (opens in a new tab)How to fix?
Upgrade github.com/rclone/rclone/backend/local to version 1.74.4 or higher.
Overview
Affected versions of this package are vulnerable to Symlink Attack in the Object.Update() method in backend/local/local.go, which passes the target stored in a .rclonelink file to os.Symlink() without validating that it resolves within the destination directory. An attacker who controls the sync source can write arbitrary files as the victim user, and gain code execution by overwriting files such as ~/.ssh/authorized_keys, shell profiles, or cron jobs, by supplying a .rclonelink whose target is an absolute path or .. sequence that rclone plants and later follows without O_NOFOLLOW. Exploitation requires the victim to sync with the --links flag from an attacker-controlled source such as a bucket, WebDAV, or HTTP share, and the writes occur with the privileges of the user running rclone.