DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88016: CVE-2026-88016: Arbitrary Filesystem Metadata Modification and Directory Traversal in rclone

#security #cve #cybersecurity

CVE-2026-88016: Arbitrary Filesystem Metadata Modification and Directory Traversal in rclone

Vulnerability ID: CVE-2026-88016
CVSS Score: 7.1
Published: 2026-09-10

CVE-2026-88016 is a high-severity directory traversal and arbitrary metadata modification vulnerability in rclone versions prior to 1.75.1. When synchronizing directories with the --links and --metadata flags, rclone fails to apply sandboxing to directory metadata operations, leading to symbolic link following that allows modification of arbitrary files outside the target destination.

TL;DR

Directory-level metadata operations in rclone with the --links flag follow attacker-controlled symbolic links, allowing arbitrary filesystem metadata modifications and local privilege escalation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-59
  • Attack Vector: Network
  • CVSS v3.1: 7.1
  • Impact: Local Privilege Escalation / Arbitrary Metadata Modification
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • rclone
  • rclone: < 1.75.1 (Fixed in: 1.75.1)

Code Analysis

Commit: a7ab39d

Local backend: Fix symlink traversal via directory metadata operations

Commit: 17b0c03

Local backend: Fix birth-time timestamp bypass when translating symlinks on Windows

Mitigation Strategies

  • Upgrade rclone to version 1.75.1 or later.
  • Disable the --links (-l) flag when syncing from untrusted sources.
  • Run the synchronization jobs with minimal system privileges.
  • Avoid using --metadata alongside --links in unpatched environments.

Remediation Steps:

  1. Identify all systems and automated scripts running rclone.
  2. Check the installed rclone version using rclone version.
  3. Download and install rclone version 1.75.1 or higher.
  4. As an interim control, review the use of the --links and --metadata arguments.

References

Read the full report for CVE-2026-88016 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)