VulnSocial

CVE-2026-54572Patch(rclone / rclone)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch rclone rclone systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

rclone CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-59

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rclone

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-07-15); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
rclone
Products
rclone

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-15: 1Mentions · 2026-07-17: 1Mentions · 2026-07-21: 1Patch / Workaround · 2026-07-17: 1Patch / Workaround · 2026-07-21: 1Technical Details · 2026-07-15: 1Technical Details · 2026-07-17: 1Technical Details · 2026-07-21: 107-1507-1707-21
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-151
Disclosure1
2026-07-171
Patch1
2026-07-211
Patch1
Full discourse3 posts
  • CyStack@CyStackSecurity
    Patch

    CVE-2026-54572: Symlink path traversal in rclone, the cloud sync tool with 58.5k GitHub stars. Sync from a malicious remote with --links. Rclone writes arbitrary files on the victim's machine. Overwrite authorized_keys or crontab and you have RCE. Plus a setuid binary planting flaw via --metadata. Upgrade to v1.74.4. Found by a CyStack researcher. Details at https://cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #rclone #CloudStorage #EnterpriseSecurity #InfoSec

    Post summary

    The tweet highlights a new rclone vulnerability and advises users to upgrade to v1.74.4, but does not provide a PoC, exploit code, or evidence of active exploitation.

    0001083
    3.7K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-54572 CVSS 7.5 - Rclone symlink validation flaw allows attackers to write files outside destination directory. Affects versions <1.74.4. Update to 1.74.4 immediately. #CVE #Vulnerability #PatchNow https://t.co/LMYN7ioZpo

    Post summary

    CVE-2026-54572 is a high‑severity Rclone symlink validation flaw affecting versions below 1.74.4; users are urged to update to 1.74.4 immediately to mitigate the risk of writing files outside the intended directory.

    0000030
    80 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-54572 Symlink Validation Bypass in Rclone Before 1.74.4 Allows Arbitrary File Write https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54572

    Post summary

    A short disclosure noting a symlink validation bypass in Rclone versions before 1.74.4 that permits arbitrary file writes; no PoC, exploit, or patch is mentioned.

    00000108
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apprclonerclone---

Explore more

Back to dashboardrclone CVEsrclone vulnerabilities