{"id":"CVE-2026-79783","aliases":["BIT-rclone-2026-79783","DEBIAN-CVE-2026-79783","EUVD-2026-65541","GHSA-945v-v9p3-v5xw","GHSA-vqwj-943v-724g","GO-2026-6190","UBUNTU-CVE-2026-79783"],"status":"published","title":"rclone before 1.74.4 Privilege Escalation via setuid Metadata","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","severity":{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00227,"percentile":0.13571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2026-08-05T20:03:14Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"Go","package":"github.com/rclone/rclone","fixed_in":["1.74.4"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rclone","fixed_in":["1.74.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.74.3"},{"fixed":"1.74.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.74.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-2","1.60.1+dfsg-3","1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.74.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.74.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.36-3","1.36-3ubuntu0.1","1.36-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.47.0+ex1-6","1.47.0+ex1-7","1.49.5-2","1.49.5-3","1.50.2-2","1.50.2-2ubuntu0.1","1.50.2-2ubuntu0.2","1.50.2-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.53.3-1","1.53.3-2","1.53.3-4","1.53.3-4ubuntu1","1.53.3-4ubuntu1.22.04.1","1.53.3-4ubuntu1.22.04.2","1.53.3-4ubuntu1.22.04.3","1.53.3-4ubuntu1.22.04.3+esm1","1.53.3-4ubuntu1.22.04.4","1.53.3-4ubuntu1.22.04.4+esm1","1.53.3-4ubuntu1.22.04.5","1.53.3-4ubuntu1.22.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-2build1","1.60.1+dfsg-3","1.60.1+dfsg-3ubuntu0.24.04.1","1.60.1+dfsg-3ubuntu0.24.04.2","1.60.1+dfsg-3ubuntu0.24.04.3","1.60.1+dfsg-3ubuntu0.24.04.4","1.60.1+dfsg-3ubuntu0.24.04.4+esm1","1.60.1+dfsg-3ubuntu0.24.04.5","1.60.1+dfsg-3ubuntu0.24.04.5+esm1","1.60.1+dfsg-3ubuntu0.24.04.6","1.60.1+dfsg-3ubuntu0.24.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4ubuntu3","1.69.3+dfsg-3","1.69.3+dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4ubuntu2","1.60.1+dfsg-4ubuntu3","1.60.1+dfsg-4ubuntu3.1","1.60.1+dfsg-4ubuntu3.1+esm1","1.60.1+dfsg-4ubuntu3.2","1.60.1+dfsg-4ubuntu3.2+esm1"]}],"products":[{"vendor":"rclone","product":"rclone"}],"references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw","tags":["vendor-advisory","exploit","web","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/rclone-before-privilege-escalation-via-setuid-metadata","tags":["third-party-advisory","web","advisory"]},{"url":"https://github.com/rclone/rclone/commit/e58f09739a35774ca82b5211d2377ac0f2051500","tags":["web","fix"]},{"url":"https://github.com/rclone/rclone/releases/tag/v1.74.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-945v-v9p3-v5xw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79783","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vqwj-943v-724g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79783.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-79783","tags":["advisory"]},{"url":"https://github.com/rclone/rclone","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-79783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79783","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-79783","title":"rclone before 1.74.4 Privilege Escalation via setuid Metadata","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T15:16:11.806Z","modified":"2026-08-25T16:11:49.885Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T13:50:27.582139Z"}],"euvd":[{"id":"EUVD-2026-65541","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T15:16:11Z","modified":"2026-08-25T16:11:49Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T18:01:32.513581Z"}],"ghsa":[{"id":"GHSA-945v-v9p3-v5xw","title":"rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote","description":"### Summary\nWhen writing an object with metadata, the local backend applies the source-supplied `mode`, `uid`, and `gid` verbatim: it parses `mode` as an octal integer and passes it straight into `os.Chmod(o.path, os.FileMode(umode))`, and passes `uid`/`gid` straight into `os.Chown`. The value is never masked to permission bits, so any value with Go's `ModeSetuid` (1\u003c\u003c23) or `ModeSetgid` (1\u003c\u003c22) bit set causes the setuid/setgid bit to be applied. Because both the file content and its metadata come from the (attacker-controlled) source remote, an attacker stores a binary of their choosing with `mode = 40000755` (and `uid = 0`); when the victim runs `rclone copy -M \u003cremote\u003e: /dest`, rclone writes the attacker's binary and makes it setuid. If the victim runs rclone as root (typical for system backup/restore), the `uid=0` chown plus setuid produces a root-owned setuid binary with attacker content — any local user then escalates to root. When rclone runs as a non-root service user, the planted setuid binary is owned by that user, giving any local user that user's privileges (lateral escalation / persistent backdoor).\n\n### Details\n`backend/local/metadata.go`, `writeMetadataToFile()`:\n```go\nuid, hasUID := o.parseMetadataInt(m, \"uid\", 10)\ngid, hasGID := o.parseMetadataInt(m, \"gid\", 10)\nif hasUID {\n    ...\n    err = os.Chown(o.path, uid, gid)        // source-controlled owner, no same-uid guard\n}\nmode, hasMode := o.parseMetadataInt(m, \"mode\", 8)\nif hasMode \u0026\u0026 mode \u003e= 0 {\n    umode := uint(mode)\n    if umode \u003c= math.MaxUint32 {\n        err = os.Chmod(o.path, os.FileMode(umode))   // \u003c-- raw value; ModeSetuid/ModeSetgid NOT masked off\n    }\n}\n```\n`os.Chmod`/`os.FileMode` honor `ModeSetuid`/`ModeSetgid`/`ModeSticky`. There is no `\u0026^ (os.ModeSetuid|os.ModeSetgid)` mask and no check that the source is trusted, so an attacker-chosen `mode` string sets those bits on the freshly written, attacker-controlled file. (Note: a legitimate local source reports `mode` in unix `st_mode` layout e.g. `0106755`, whose bit 1\u003c\u003c23 is unset, so honest copies happen to drop setuid — but the attacker supplies the Go-`FileMode` layout `40000755` directly, which sets it.)\n\n### PoC\n1) Get the official stable binary:\n```\ncurl -fsSLO https://downloads.rclone.org/v1.74.3/rclone-v1.74.3-linux-amd64.zip\nunzip -j rclone-v1.74.3-linux-amd64.zip '*/rclone' -d .      # ./rclone -\u003e v1.74.3\n```\n2) Create a payload (the attacker-controlled binary content) and copy it with the malicious `mode` metadata:\n```\nmkdir -p msrc mdst \u0026\u0026 cp /bin/true msrc/payload\n./rclone copy -M --metadata-set mode=40000755 msrc mdst       # 40000755 = Go FileMode setuid|0755\n```\n3) Observe — the destination file is now setuid:\n```\nstat -c '%A %a' mdst/payload\n-rwsr-xr-x 4755                                               # 's' = setuid bit SET on attacker binary\n```\nVariants: `mode=20000755` → setgid (`-rwxr-sr-x`); `mode=60000755` → both (`-rwsr-sr-x`). With rclone run as root and the source object also carrying `uid=0`/`gid=0`, the file is chown'd root:root, yielding a root-owned setuid binary executable by any local user.\n\n\n### Impact\nA victim performing a metadata-preserving copy/restore (`-M`) from an untrusted or compromised remote installs an attacker-chosen executable with the setuid/setgid bit set. Run as root (system backup/restore, the common case for `--metadata`), this is a root-owned setuid root backdoor executable by any local user → local privilege escalation to root. Run as a non-root user, it is a setuid backdoor for that service account. The companion `uid`/`gid` application lets a root-run transfer also reassign ownership of written files arbitrarily.\n\n### Remediation\nMask special bits before applying mode from metadata — `os.Chmod(o.path, os.FileMode(umode).Perm())` (or `umode \u0026 0o777`) — and do not honor setuid/setgid/sticky from source metadata; gate `uid`/`gid`/setuid application behind an explicit opt-in (e.g. `--local-metadata-set-ownership`) that is off by default, and document that `-M` from untrusted remotes must not restore privileged bits. Regression test: copying an object with `mode=40000755`/`uid=0` must produce a non-setuid, caller-owned file unless the opt-in is set.","status":"published","published":"2026-08-05T20:03:14Z","modified":"2026-08-05T20:03:14Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:40:56.852119Z"},{"id":"GHSA-vqwj-943v-724g","title":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode...","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T18:31:54Z","modified":"2026-08-25T18:32:01Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:10:57.962573Z"}],"nvd":[{"id":"CVE-2026-79783","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T16:17:30.383Z","modified":"2026-09-10T20:46:19.78Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"CVE-2026-79783","title":"rclone before 1.74.4 Privilege Escalation via setuid Metadata","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T15:16:11.806Z","modified":"2026-10-28T02:30:21.82588913Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"DEBIAN-CVE-2026-79783","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T16:17:30.383Z","modified":"2026-10-01T03:03:47.194079417Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:46:04.001673Z"},{"id":"GHSA-945v-v9p3-v5xw","title":"rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote","description":"### Summary\nWhen writing an object with metadata, the local backend applies the source-supplied `mode`, `uid`, and `gid` verbatim: it parses `mode` as an octal integer and passes it straight into `os.Chmod(o.path, os.FileMode(umode))`, and passes `uid`/`gid` straight into `os.Chown`. The value is never masked to permission bits, so any value with Go's `ModeSetuid` (1\u003c\u003c23) or `ModeSetgid` (1\u003c\u003c22) bit set causes the setuid/setgid bit to be applied. Because both the file content and its metadata come from the (attacker-controlled) source remote, an attacker stores a binary of their choosing with `mode = 40000755` (and `uid = 0`); when the victim runs `rclone copy -M \u003cremote\u003e: /dest`, rclone writes the attacker's binary and makes it setuid. If the victim runs rclone as root (typical for system backup/restore), the `uid=0` chown plus setuid produces a root-owned setuid binary with attacker content — any local user then escalates to root. When rclone runs as a non-root service user, the planted setuid binary is owned by that user, giving any local user that user's privileges (lateral escalation / persistent backdoor).\n\n### Details\n`backend/local/metadata.go`, `writeMetadataToFile()`:\n```go\nuid, hasUID := o.parseMetadataInt(m, \"uid\", 10)\ngid, hasGID := o.parseMetadataInt(m, \"gid\", 10)\nif hasUID {\n    ...\n    err = os.Chown(o.path, uid, gid)        // source-controlled owner, no same-uid guard\n}\nmode, hasMode := o.parseMetadataInt(m, \"mode\", 8)\nif hasMode \u0026\u0026 mode \u003e= 0 {\n    umode := uint(mode)\n    if umode \u003c= math.MaxUint32 {\n        err = os.Chmod(o.path, os.FileMode(umode))   // \u003c-- raw value; ModeSetuid/ModeSetgid NOT masked off\n    }\n}\n```\n`os.Chmod`/`os.FileMode` honor `ModeSetuid`/`ModeSetgid`/`ModeSticky`. There is no `\u0026^ (os.ModeSetuid|os.ModeSetgid)` mask and no check that the source is trusted, so an attacker-chosen `mode` string sets those bits on the freshly written, attacker-controlled file. (Note: a legitimate local source reports `mode` in unix `st_mode` layout e.g. `0106755`, whose bit 1\u003c\u003c23 is unset, so honest copies happen to drop setuid — but the attacker supplies the Go-`FileMode` layout `40000755` directly, which sets it.)\n\n### PoC\n1) Get the official stable binary:\n```\ncurl -fsSLO https://downloads.rclone.org/v1.74.3/rclone-v1.74.3-linux-amd64.zip\nunzip -j rclone-v1.74.3-linux-amd64.zip '*/rclone' -d .      # ./rclone -\u003e v1.74.3\n```\n2) Create a payload (the attacker-controlled binary content) and copy it with the malicious `mode` metadata:\n```\nmkdir -p msrc mdst \u0026\u0026 cp /bin/true msrc/payload\n./rclone copy -M --metadata-set mode=40000755 msrc mdst       # 40000755 = Go FileMode setuid|0755\n```\n3) Observe — the destination file is now setuid:\n```\nstat -c '%A %a' mdst/payload\n-rwsr-xr-x 4755                                               # 's' = setuid bit SET on attacker binary\n```\nVariants: `mode=20000755` → setgid (`-rwxr-sr-x`); `mode=60000755` → both (`-rwsr-sr-x`). With rclone run as root and the source object also carrying `uid=0`/`gid=0`, the file is chown'd root:root, yielding a root-owned setuid binary executable by any local user.\n\n\n### Impact\nA victim performing a metadata-preserving copy/restore (`-M`) from an untrusted or compromised remote installs an attacker-chosen executable with the setuid/setgid bit set. Run as root (system backup/restore, the common case for `--metadata`), this is a root-owned setuid root backdoor executable by any local user → local privilege escalation to root. Run as a non-root user, it is a setuid backdoor for that service account. The companion `uid`/`gid` application lets a root-run transfer also reassign ownership of written files arbitrarily.\n\n### Remediation\nMask special bits before applying mode from metadata — `os.Chmod(o.path, os.FileMode(umode).Perm())` (or `umode \u0026 0o777`) — and do not honor setuid/setgid/sticky from source metadata; gate `uid`/`gid`/setuid application behind an explicit opt-in (e.g. `--local-metadata-set-ownership`) that is off by default, and document that `-M` from untrusted remotes must not restore privileged bits. Regression test: copying an object with `mode=40000755`/`uid=0` must produce a non-setuid, caller-owned file unless the opt-in is set.","status":"published","published":"2026-08-05T20:03:14Z","modified":"2026-09-25T14:25:48.311310825Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2026-79783","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-08-25T16:17:00Z","modified":"2026-10-17T13:01:10.024813898Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"BIT-rclone-2026-79783","title":"rclone before 1.74.4 Privilege Escalation via setuid Metadata","description":"rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.","status":"published","published":"2026-09-25T12:30:16.445Z","modified":"2026-09-25T14:25:48.311310825Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"GO-2026-6190","title":"Unsafe file permission restoration from metadata in github.com/rclone/rclone","description":"Unsafe file permission restoration from metadata in github.com/rclone/rclone","status":"published","published":"2026-08-18T16:38:10Z","modified":"2026-09-25T14:25:48.311310825Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}