CVE catalog

CVE-2026-54572

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Published: Jul 8, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.40% · Oct 25, 2026

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rclone	sid	`1.75.2-2`	fixed
Debian	rclone	trixie	`1.60.1+dfsg-4`	vulnerable
Debian	rclone	bookworm	`1.60.1+dfsg-2`	vulnerable
Cpe	rclone	Not reported	Not reported	vulnerable
Go	github.com/rclone/rclone	Not reported	`1.74.4`	fixed
Opensuse	rclone	tumbleweed	`1.74.4-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rclone	source	sid	`1.75.2-1`	not yet assigned	Not reported	[1142269]
Debian	rclone	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1142269]
Debian	rclone	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1142269]
Go	github.com/rclone/rclone	go	Not reported	`1.74.4`	Not reported	Not reported	Not reported
Opensuse	rclone	rpm	tumbleweed	`1.74.4-1.1`	Not reported	OPENSUSE-SU-2026:11241-1	Not reported

[Debian bug #1142269]

Notes

[trixie] rclone: Minor issue [bookworm] rclone: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-github-rclone-rclone-dev]Affected
Source package: [rclone]
Details (2)
- 1.60.1+dfsg-2 · all · bookworm
  Affected
  nvd · rclone · debian · bookworm; nvd · rclone · debian · 12
- 1.60.1+dfsg-2 · all · bookworm
  Affected
  nvd · rclone · debian · bookworm; nvd · rclone · debian · 12
[rclone]Affected
Source package: [rclone]
Details (2)
- 1.60.1+dfsg-2+b5 · amd64 · bookworm
  Affected
  nvd · rclone · debian · bookworm; nvd · rclone · debian · 12
- 1.60.1+dfsg-2+b5 · arm64 · bookworm
  Affected
  nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

[Debian 13 (Trixie)]

[golang-github-rclone-rclone-dev]Affected
Source package: [rclone]
Details (2)
- 1.60.1+dfsg-4 · all · trixie
  Affected
  nvd · rclone · debian · 13
- 1.60.1+dfsg-4 · all · trixie
  Affected
  nvd · rclone · debian · 13
[rclone]Affected
Details (2)
- 1.60.1+dfsg-4 · amd64 · trixie
  Affected
  nvd · rclone · debian · 13
- 1.60.1+dfsg-4 · arm64 · trixie
  Affected
  nvd · rclone · debian · 13

[openSUSE Tumbleweed]

[rclone-bash-completion]Unknown
Source package: [rclone]
Details (1)
- 1.75.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.74.4-1.1
  Version impact unknown
  nvd · rclone · opensuse · tumbleweed
[rclone-zsh-completion]Unknown
Source package: [rclone]
Details (1)
- 1.75.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.74.4-1.1
  Version impact unknown
  nvd · rclone · opensuse · tumbleweed
[rclone]Fixed
Source package: [rclone]
Details (1)
- 1.75.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.74.4-1.1
  nvd · rclone · opensuse · tumbleweed

Observed: Oct 23, 2026, 9:44:26 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]