---
id: CVE-2026-88016
title: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers
summary: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers. Prior to 1.75.1, when backend/local runs
  with --links, a source .rclonelink object can plant a symlink in the
  destination and l…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L'
cwe:
  - CWE-59
  - CWE-281
vendor: rclone
product: rclone
affected:
  - rclone < 1.75.1
patched:
  - rclone 1.75.1
published: '2026-09-10'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T15:17:24.307'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88016'
references:
  - url: >-
      https://github.com/rclone/rclone/commit/17b0c03338a857bcb0a68d2d4c82ddbdec3f7893
    label: security-advisories@github.com
  - url: >-
      https://github.com/rclone/rclone/commit/a7ab39d3d1958afa1446982c1dc4e4a73a887e3e
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.75.1'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88016'
  - url: 'https://github.com/rclone/rclone'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88016.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88016'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-88016'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - go
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T14:43:38.560950Z'
epss: 0.00271
epssPercentile: 0.17138
ingestedAt: '2026-09-13T14:40:22.939Z'
aliases:
  - GHSA-f8g7-2xjc-7mfh
  - BIT-rclone-2026-88016
  - GO-2026-6459
ecosystem: go
scores:
  nvd: 7.1
  osv: 6.5
  vendor: 7.1
---

## Overview

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

## Affected

- `rclone < 1.75.1`

## Remediation

Upgrade past the affected range:

- `rclone 1.75.1`

## Package advisory (CVE-2026-88016)

Affected packages:

- `github.com/rclone/rclone < 1.75.1`

Patched in:

- `github.com/rclone/rclone 1.75.1`

Source: https://osv.dev/vulnerability/GHSA-f8g7-2xjc-7mfh

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88016.json)