Rclone is a command-line tool for syncing files with cloud storage providers. In versions before 1.74.4, when using the -l/--links option, rclone serializes symlinks as .rclonelink text objects and recreates them on the local destination without validating the symlink target. This lack of validation allows an attacker controlling the remote source to plant symlinks that point outside the intended destination directory. Subsequent file writes follow these symlinks, resulting in arbitrary file writes to locations outside the destination directory with attacker-controlled content. The vulnerability is addressed and fixed in rclone version 1.74.4.

An attacker with control over the remote source can exploit this vulnerability to cause rclone to write files outside the intended destination directory on the local system. This can lead to arbitrary file overwrite, potentially compromising system integrity or security depending on the files overwritten. There are no known exploits in the wild at this time.

Upgrade rclone to version 1.74.4 or later, where this vulnerability is fixed. The fix involves validating symlink targets to prevent escaping the destination directory. No additional mitigation is required once the update is applied.