Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-116195— Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Quick assessment

Affected

rclone rclone

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 1.75.2 之前的 Rclone 版本中，其本地后端（local backend）的函数存在路径遍历漏洞。该函数在路径包含性检查之后才移除后缀，导致某些名称能够解析到目标根目录之外。攻击者可以在通过和选项同步的源树中创建一个名为的目录，从而修改目标目录父目录的所有权、时间戳以及扩展属性（xattrs）。

CVSS 6.1 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 2 AI

T1083.001 T1083 · File and Directory Discovery

Affected Version Matrix 2

Vendor	Product	Version Range	Status
rclone	rclone	`< 1.75.2`	affected
		`1.75.2`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Source: CVE Program / CVE List V5

Vulnerability Description

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rclone	rclone	0 ~ 1.75.2	-

II. Public POCs for CVE-2026-116195

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116195

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116195 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116195

Same Patch Batch · rclone · 2026-10-25 · 10 CVEs total

CVE-2026-116189	7.5 HIGH	rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
CVE-2026-116191	7.5 HIGH	Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
CVE-2026-116194	6.8 MEDIUM	Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
CVE-2026-116192	5.9 MEDIUM	rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
CVE-2026-116188	5.3 MEDIUM	rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
CVE-2026-116196	5.3 MEDIUM	Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
CVE-2026-116193	5.3 MEDIUM	Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
CVE-2026-116187	5.0 MEDIUM	Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
CVE-2026-116190	3.7 LOW	rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

IV. Related Vulnerabilities

Same product: rclone

Same vendor: rclone

Same weakness: CWE-22