Search: CVE-2026-54572

Rclone versions prior to 1.74.4 contain a vulnerability when using the -l/--links option to sync symlinks. The software serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the symlink target. This allows an attacker controlling the remote source to create a symlink that escapes the intended destination directory, causing subsequent file writes to be placed outside the target directory with attacker-chosen content. This issue is fixed in rclone version 1.74.4.