Every CVE Search/ Get API key

CVE-2026-88016

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

7.1 HighFix available

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

0.19%Unchanged since Sep 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
CVE-2026-88016
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-59, CWE-281
Updated
2026-11-02
EUVDEUVD-2026-75576 7.1

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
EUVD-2026-75576
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-f8g7-2xjc-7mfh 6.5

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary

With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim (preserved by design for faithful backups). Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A local Directory always has translatedLink=false, so when the destination path already exists as a planted symlink, rclone applies chmod/chown/chtimes through that symlink to a target outside the destination tree. An attacker who controls the source contents (malicious/compromised remote, shared bucket) obtains attacker-valued chmod/chown/chtimes of an arbitrary path outside the backup destination.

Root Cause

  • MkdirMetadata (backend/local/local.go:895) calls f.lstat (=os.Lstat, local.go:465) on the destination path. On a pre-planted symlink, os.Lstat succeeds, so the errors.Is(err, os.ErrNotExist) branch (local.go:896) that would create a real directory via the os.Root-guarded f.Mkdir is not taken. Instead a Directory is built directly on the symlink path.
  • writeMetadataToFile runs raw os.Chown (backend/local/metadata.go:131) and os.Chmod (metadata.go:158); setTimes runs raw os.Chtimes (backend/local/local.go:1318).
  • The CVE-2024-52522 NOFOLLOW fix (os.Lchown/lChmod/lChtimes) is gated on if o.translatedLink (metadata.go:128/150, local.go:1315). A Directory (newDirectory→newObject with no .rclonelink suffix) is never translatedLink, so it always takes the raw following branch. The CVE-2026-54572 os.Root fix covers only content writes, not metadata syscalls.

Impact

Attacker-controlled chmod/chown/chtimes (values taken from the source directory's mode/uid/gid/mtime) applied to any file or directory outside the destination. chtimes (mtime) escape works with just --links and default flags; chmod/chown escape additionally needs --metadata. When rclone runs as root with --metadata and a source uid=0, the chown primitive reaches the CVE-2024-52522 privilege-escalation ceiling (take ownership of an out-of-tree path).

Proof of Concept

mkdir -p /src /dest
# run 1: source object pwn.rclonelink whose body = /home/victim/secret.d
printf '/home/victim/secret.d' > /src/pwn.rclonelink
rclone sync --links /src /dest              # plants /dest/pwn -> /home/victim/secret.d
# attacker swaps source pwn to a real directory with chosen metadata:
rm /src/pwn.rclonelink ; mkdir -p /src/pwn/keep ; chmod 777 /src/pwn
rclone sync --links --metadata /src /dest   # MkdirMetadata sees /dest/pwn exists (symlink) ->
                                            # chmod 0777 applied THROUGH it to /home/victim/secret.d
ls -ld /home/victim/secret.d                # => drwxrwxrwx  (outside dir, attacker-chosen mode)

A single-run PoC is achievable against directory-based object sources (drive/onedrive-class) that satisfy both ReadDirMetadata and CanHaveEmptyDirectories and can present pwn.rclonelink and pwn/ simultaneously. Local→local uses the two-run backup model (same repeated-backup model as CVE-2024-52522 and CVE-2026-54572). Verified end-to-end against the real fs/sync.Sync engine on HEAD: the two-run backup backdated the outside target's mtime and chmod'd it 0777 while os.Root correctly blocked the content-copy of pwn/keep — isolating the metadata gap.

Attack Chain

  1. Entry. Victim runs rclone copy/sync --links [--metadata] <untrusted-remote>: /dest. Attacker controls source contents.
    • Guard: none — --links copying an untrusted remote is a documented, supported operation.
  2. Plant symlink. Source serves pwn.rclonelink with body = absolute outside path; rclone recreates dst/pwn → outside.
    • Guard: Fs.symlink routes creation through os.Root.Symlink (local.go:~1552).
    • Bypass proof: os.Root creates the link verbatim by design (commit 1154afe); the…
Record
GHSA-f8g7-2xjc-7mfh
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:L
Weakness
CWE-59, CWE-281
Updated
2026-11-02
NVD 7.1

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
CVE-2026-88016
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-59, CWE-281
Updated
2026-11-02
OSV 7.1

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
CVE-2026-88016
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-281, CWE-59
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88016 7.1

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
DEBIAN-CVE-2026-88016
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-f8g7-2xjc-7mfh 6.5

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary

With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim (preserved by design for faithful backups). Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A local Directory always has translatedLink=false, so when the destination path already exists as a planted symlink, rclone applies chmod/chown/chtimes through that symlink to a target outside the destination tree. An attacker who controls the source contents (malicious/compromised remote, shared bucket) obtains attacker-valued chmod/chown/chtimes of an arbitrary path outside the backup destination.

Root Cause

  • MkdirMetadata (backend/local/local.go:895) calls f.lstat (=os.Lstat, local.go:465) on the destination path. On a pre-planted symlink, os.Lstat succeeds, so the errors.Is(err, os.ErrNotExist) branch (local.go:896) that would create a real directory via the os.Root-guarded f.Mkdir is not taken. Instead a Directory is built directly on the symlink path.
  • writeMetadataToFile runs raw os.Chown (backend/local/metadata.go:131) and os.Chmod (metadata.go:158); setTimes runs raw os.Chtimes (backend/local/local.go:1318).
  • The CVE-2024-52522 NOFOLLOW fix (os.Lchown/lChmod/lChtimes) is gated on if o.translatedLink (metadata.go:128/150, local.go:1315). A Directory (newDirectory→newObject with no .rclonelink suffix) is never translatedLink, so it always takes the raw following branch. The CVE-2026-54572 os.Root fix covers only content writes, not metadata syscalls.

Impact

Attacker-controlled chmod/chown/chtimes (values taken from the source directory's mode/uid/gid/mtime) applied to any file or directory outside the destination. chtimes (mtime) escape works with just --links and default flags; chmod/chown escape additionally needs --metadata. When rclone runs as root with --metadata and a source uid=0, the chown primitive reaches the CVE-2024-52522 privilege-escalation ceiling (take ownership of an out-of-tree path).

Proof of Concept

mkdir -p /src /dest
# run 1: source object pwn.rclonelink whose body = /home/victim/secret.d
printf '/home/victim/secret.d' > /src/pwn.rclonelink
rclone sync --links /src /dest              # plants /dest/pwn -> /home/victim/secret.d
# attacker swaps source pwn to a real directory with chosen metadata:
rm /src/pwn.rclonelink ; mkdir -p /src/pwn/keep ; chmod 777 /src/pwn
rclone sync --links --metadata /src /dest   # MkdirMetadata sees /dest/pwn exists (symlink) ->
                                            # chmod 0777 applied THROUGH it to /home/victim/secret.d
ls -ld /home/victim/secret.d                # => drwxrwxrwx  (outside dir, attacker-chosen mode)

A single-run PoC is achievable against directory-based object sources (drive/onedrive-class) that satisfy both ReadDirMetadata and CanHaveEmptyDirectories and can present pwn.rclonelink and pwn/ simultaneously. Local→local uses the two-run backup model (same repeated-backup model as CVE-2024-52522 and CVE-2026-54572). Verified end-to-end against the real fs/sync.Sync engine on HEAD: the two-run backup backdated the outside target's mtime and chmod'd it 0777 while os.Root correctly blocked the content-copy of pwn/keep — isolating the metadata gap.

Attack Chain

  1. Entry. Victim runs rclone copy/sync --links [--metadata] <untrusted-remote>: /dest. Attacker controls source contents.
    • Guard: none — --links copying an untrusted remote is a documented, supported operation.
  2. Plant symlink. Source serves pwn.rclonelink with body = absolute outside path; rclone recreates dst/pwn → outside.
    • Guard: Fs.symlink routes creation through os.Root.Symlink (local.go:~1552).
    • Bypass proof: os.Root creates the link verbatim by design (commit 1154afe); the…
Record
GHSA-f8g7-2xjc-7mfh
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:L
Weakness
CWE-281, CWE-59
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88016 7.1

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
UBUNTU-CVE-2026-88016
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
OSVBIT-rclone-2026-88016 No score

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod, os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker controlling source contents can therefore apply selected ownership, permissions, modification times, or birth times to a file or directory outside the destination, with --metadata required for chmod and chown while modification time is applied by the normal directory workflow. This issue is fixed in version 1.75.1.

Record
BIT-rclone-2026-88016
Updated
2026-11-02
OSVGO-2026-6459 No score

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

Record
GO-2026-6459
Updated
2026-11-02
OSVopenSUSE-SU-2026:21897-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
openSUSE-SU-2026:21897-1
Updated
2026-11-02
OSVSUSE-SU-2026:23855-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23855-1
Updated
2026-11-02
OSVSUSE-SU-2026:23863-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/rclone/rclone
Go
 through 1.75.0
1.75.1
rclone
Bitnami
 before 1.75.1
1.75.1
rclone
Debian:12
 All versions, plus listed versions
1.60.1+dfsg-21.60.1+dfsg-31.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
rclone
Debian:13
 All versions, plus listed versions
1.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
github.com/rclone/rclone
Go
 before 1.75.1
1.75.1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
rclone
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.36-31.36-3ubuntu0.11.36-3ubuntu0.2
 None known
rclone
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.47.0+ex1-61.47.0+ex1-71.49.5-21.49.5-31.50.2-21.50.2-2ubuntu0.11.50.2-2ubuntu0.21.50.2-2ubuntu0.2+esm1
 None known
rclone
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.53.3-11.53.3-21.53.3-41.53.3-4ubuntu11.53.3-4ubuntu1.22.04.1
Show 7 moreShow less
1.53.3-4ubuntu1.22.04.21.53.3-4ubuntu1.22.04.31.53.3-4ubuntu1.22.04.3+esm11.53.3-4ubuntu1.22.04.41.53.3-4ubuntu1.22.04.4+esm11.53.3-4ubuntu1.22.04.51.53.3-4ubuntu1.22.04.5+esm1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
rclone
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.60.1+dfsg-2build11.60.1+dfsg-31.60.1+dfsg-3ubuntu0.24.04.11.60.1+dfsg-3ubuntu0.24.04.21.60.1+dfsg-3ubuntu0.24.04.3
Show 6 moreShow less
1.60.1+dfsg-3ubuntu0.24.04.41.60.1+dfsg-3ubuntu0.24.04.4+esm11.60.1+dfsg-3ubuntu0.24.04.51.60.1+dfsg-3ubuntu0.24.04.5+esm11.60.1+dfsg-3ubuntu0.24.04.61.60.1+dfsg-3ubuntu0.24.04.6+esm1
 None known
rclone
Ubuntu:26.10
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu31.69.3+dfsg-31.69.3+dfsg-3ubuntu1
 None known
rclone
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu21.60.1+dfsg-4ubuntu31.60.1+dfsg-4ubuntu3.11.60.1+dfsg-4ubuntu3.1+esm11.60.1+dfsg-4ubuntu3.21.60.1+dfsg-4ubuntu3.2+esm1
 None known
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88016 is a high vulnerability (CVSS 7.1) in Rclone, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in github.com/rclone/rclone 1.75.1.

References

Show 98 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open