Hi,
The following vulnerabilities were published for rclone.
CVE-2026-54572[0]:
| Rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.74.4, with
| -l/--links, rclone serializes symlinks as .rclonelink text objects
| and recreates them on a local destination without validating the
| target, allowing an attacker-controlled remote to plant an escaping
| symlink and cause a following object write to land outside the
| destination with attacker-chosen contents. This issue is fixed in
| version 1.74.4.
CVE-2026-59732[1]:
| Rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.74.4, rclone
| archive extract can write extracted files outside the user-selected
| destination prefix when extracting a crafted archive containing
| parent path components such as ../, allowing creation or overwrite
| of sibling objects in the same bucket or path scope. This issue is
| fixed in version 1.74.4.
CVE-2026-59733[2]:
| Rclone is a command-line program to sync files and directories to
| and from different cloud storage providers. Prior to 1.74.4, rclone
| serve restic --private-repos enforces authorization using the routed
| user path segment while building the backend object key from the raw
| uncleaned URL path, allowing an authenticated user to include .. in
| a request such as //..//config and read, overwrite, or delete
| another user's private repository on backends that clean path
| components. This issue is fixed in version 1.74.4.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-54572
https://www.cve.org/CVERecord?id=CVE-2026-54572
[1] https://security-tracker.debian.org/tracker/CVE-2026-59732
https://www.cve.org/CVERecord?id=CVE-2026-59732
[2] https://security-tracker.debian.org/tracker/CVE-2026-59733
https://www.cve.org/CVERecord?id=CVE-2026-59733
Regards,
Salvatore