Path Traversal Vulnerability in Rclone Affecting Rclone Versions Prior to 1.75.2

CVE-2026-116195

What is CVE-2026-116195?

Rclone versions prior to 1.75.2 are vulnerable to a path traversal flaw in the local backend's translateLink function. This vulnerability allows an attacker to manipulate paths after containment checks, leading to the potential exposure of directories outside of the intended destination root. By planting a specially crafted directory named ...rclonelink in a synchronized source tree using the --links and --metadata options, unwanted changes to ownership, timestamps, and extended attributes of the destination's parent directory can occur. It is crucial for users to upgrade to the latest version to mitigate this security risk.

References