Bug 2560400 (CVE-2026-116195)

Summary: CVE-2026-116195 github.com/rclone/rclone: rclone: Path traversal via link suffix trimming
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, cmah, eaguilar, ebaron, gparvin, jbalunas, jmatsuok, jtolenti, pjindal, rhaigner, tsze
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in rclone. A path traversal vulnerability exists in the local storage backend where link suffixes are trimmed after directory containment checks are performed. By placing a specially crafted directory into a source tree synchronized with link and metadata flags enabled, an attacker can traverse outside the intended target directory and alter ownership, timestamps, and extended attributes of the parent directory.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-25 13:32:19 UTC 
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a source tree synced with --links and --metadata to change ownership, timestamps, and xattrs of the destination's parent directory.