All errata/c10f2/ALT-PU-2026-11227-2
ALT-PU-2026-11227-2

Package update rclone in branch c10f2

Version1.74.4-alt1
Task#425417
Published2026-08-06
Max severityHIGH
Severity:

Closed issues (6)

CVE-2026-54572
HIGH8.8

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

Published: 2026-07-14Modified: 2026-07-17
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
References
CVE-2026-59732
MEDIUM5.0

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

Published: 2026-07-14Modified: 2026-07-21
CVSS 3.xMEDIUM 5.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
References
CVE-2026-59733
HIGH8.8

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.

Published: 2026-07-14Modified: 2026-07-29
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-4vr5-p2gc-h23p
MEDIUM5.0

rclone archive extract allows S3 destination prefix escape via crafted archive paths

Published: 2026-08-05
CVSS 3.xMEDIUM 5.0
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
References
GHSA-cf44-9pgv-m4xc
HIGH7.5

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Published: 2026-08-05
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
References
GHSA-fqj9-69pf-6pjg
HIGH8.8

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Published: 2026-08-05
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References