CVE-2026-88016
Received Received - Intake

Symlink Bypass in Rclone File Sync Tool

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88016
EUVD
EUVD-2026-75576

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rclone rclone to 1.75.1 (exc)
rclone rclone 1.75.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-281 The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88016 is a vulnerability in rclone versions before 1.75.1 where using the --links flag allows an attacker to plant a symlink in the destination. Directory metadata operations like chmod, chown, and chtimes can then follow this symlink and apply changes to files outside the intended backup directory. The issue occurs because metadata operations bypass the os.Root sandbox used for content writes.

Detection Guidance

To detect this vulnerability, check if you are running rclone version 1.75.0 or earlier. Run 'rclone version' to verify the installed version. If you are using the --links flag during sync operations, inspect your sync commands for potential symlink exploitation. Monitor for unexpected permission or ownership changes on files outside intended directories.

Impact Analysis

An attacker controlling source contents could modify permissions, ownership, or timestamps of arbitrary files outside the backup destination. If rclone runs as root, this could lead to privilege escalation. The attack requires two steps: planting a symlink and then applying metadata changes through it.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity and access control requirements in GDPR and HIPAA. Unauthorized permission changes might expose sensitive data or allow unauthorized access, impacting compliance with these regulations.

Mitigation Strategies

Upgrade rclone to version 1.75.1 or later immediately. Avoid using the --links flag in sync operations. If you must use --links, ensure no untrusted sources are involved. Review and restrict permissions of files and directories that rclone can access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart