Rclone versions before 1.75.2 have a path traversal vulnerability in the local backend's translateLink function. This flaw occurs because the function trims the .rclonelink suffix after performing a containment check, allowing a path to resolve outside the intended destination root. An attacker can exploit this by planting a specially named directory in a source tree synced with --links and --metadata, potentially modifying ownership, timestamps, and extended attributes of the destination's parent directory.