rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to… (CVE-2026-79783)

The vulnerability in rclone prior to version 1.74.4 involves improper masking of special permission bits during the application of source-supplied mode metadata in the local backend. Specifically, attackers can set setuid or setgid bits on files they control. When rclone copies files from an untrusted remote with metadata preservation enabled, an attacker can place a setuid binary that, if executed, escalates privileges to root when rclone runs as root, or to the service account user otherwise.

An attacker able to supply files to an untrusted remote and trigger rclone to copy those files locally with metadata preservation can create files with setuid/setgid bits. This can lead to privilege escalation to root or the rclone service account user, depending on the execution context of rclone. The CVSS score is 3.6 (medium), reflecting local attack vector with high attack complexity and requiring user interaction.

Upgrade rclone to version 1.74.4 or later, where this issue is fixed. Until then, avoid copying files with metadata preservation from untrusted remotes or running rclone as root. Patch status is confirmed fixed in 1.74.4. No vendor advisory content was provided, but the version-based fix is explicit.