CyberRota Analysis
AI-GeneratedRclone versions prior to 1.74.4 are vulnerable to a symlink serialization flaw that allows attackers to exploit the -l/--links option, potentially writing unauthorized data outside the intended destination. This could lead to unauthorized file manipulation or data exposure, posing significant risks to systems utilizing Rclone for cloud storage synchronization. Organizations using Rclone should prioritize upgrading to version 1.74.4 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)