Skip to content
OpenAdvisories
High WID-SEC-2026-3196 3 CVEs

rclone: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Sep 6, 2026 · Updated Oct 25, 2026 · Revision 3 · de-DE

Vendor: SUSE Product: openSUSE Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen oder zu manipulieren, sowie um einen Denial of Service herbeizuführen.

Product

Rclone ist ein Open-Source-Befehlszeilenprogramm zur Synchronisierung von Dateien und Verzeichnissen mit verschiedenen Cloud-Speicherdiensten.

Vulnerabilities 3

  • Medium 5.4
    CVE-2024-52522

    Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify owners…

    rclone rclone rclone rclone Debian Ubuntu Alpine Wolfi Go
  • Low 3.4
    CVE-2026-93987

    rclone serve docker Path Traversal via Volume Name

    rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name…

    rclone rclone rclone rclone Debian Ubuntu
  • Low 3.1
    CVE-2026-93986

    rclone before 1.75.1 Path Traversal via Directory Listing Names

    rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references …

    rclone rclone rclone rclone Debian Ubuntu

Revision history

  1. #3

    Neue Updates von openSUSE aufgenommen

  2. #2

    Referenz(en) aufgenommen: CVE-2026-93986, EUVD-2026-83591, CVE-2026-93987, EUVD-2026-83592, GHSA-JG5V-4P8W-HWM3

  3. #1

    Initiale Fassung

References