GO-2026-6191
Arbitrary file write via --links symlinks in github.com/rclone/rclone
At a glance
- Published
- Updated
- CVE
- CVE-2026-54572
- Aliases
- BIT-rclone-2026-54572, GHSA-cf44-9pgv-m4xc
Description
Arbitrary file write via --links symlinks in github.com/rclone/rclone
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/rclone/rclone | introduced 0, fixed 1.74.4 |
References
- https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc ADVISORY
- https://github.com/rclone/rclone/commit/1154afebee986180b489084d38e2a0c578751498 FIX
- https://github.com/rclone/rclone/commit/874a804f5289517defdd7de68b2a374837080265 FIX
- https://github.com/rclone/rclone/releases/tag/v1.74.4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |