CVE-2026-88015Medium· 5.3▾ TwilightPoC availablerclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.De…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/rclone/rclone < 1.75.1Patched in:
github.com/rclone/rclone 1.75.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88018Critical· 9.8rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88044Critical· 9.1rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88016High· 7.1rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88017High· 7.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88013Low· 3.7rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88045High· 7.5rclone is a command-line program to sync files and directories to and from different cloud storage providers