CVE-2026-116195 rclone CVE debrief

Who should care

Defenders responsible for Rclone installations, particularly those using --links and --metadata, should assess exposure and verify versions. This includes operators managing Rclone deployments, platform administrators, vulnerability management teams, and security teams monitoring for potential impacts and necessary mitigations.

Why it matters

CVE-2026-116195 is a path traversal vulnerability in Rclone before version 1.75.2, allowing attackers to change ownership, timestamps, and xattrs of the destination's parent directory. Defenders should prioritize verifying Rclone versions, reviewing configurations, and monitoring for suspicious activity.

• Verify Rclone version to prevent potential path traversal
• Review configurations to prevent unauthorized changes
• Monitor for suspicious activity to detect potential exploitation

Technical summary

The vulnerability exists in the local backend's translateLink function of Rclone before version 1.75.2, which trims the .rclonelink suffix from a path after the containment check. This allows attackers to plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory. The issue impacts Rclone installations using --links and --metadata, particularly affecting defenders responsible for maintaining these configurations.

Defensive priority

Defenders should prioritize verifying Rclone versions and updating to 1.75.2 or later, reviewing configurations for --links and --metadata usage, and monitoring for suspicious activity.

Recommended defensive actions

• Verify Rclone version and update to 1.75.2 or later
• Review configurations for --links and --metadata usage
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify Rclone versions, review configurations for --links and --metadata usage, and monitor for suspicious activity to understand potential exposure and impacts. Evidence from the CVE Program and NVD detail page supports this assessment, but additional verification is necessary to confirm affected deployments and assess potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.