Bug 2500758 (CVE-2026-54572)

Summary: CVE-2026-54572 rclone: Rclone: Arbitrary file write via malicious symbolic link handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Rclone, a command-line program for syncing files with cloud storage. When handling symbolic links (symlinks) with the -l or --links option, Rclone serializes them as text objects and recreates them without proper validation. A remote attacker could exploit this by providing a malicious symlink, allowing subsequent file writes to occur outside the intended destination with content chosen by the attacker. This could lead to unauthorized modification of files on the system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2508365, 2508366    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-14 22:05:08 UTC 
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.