Description
rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.
CVSS 3.6EPSS 0.13999999999999999%Risque 0.36
Voir la source- Publication
- 2026-08-25 16:17:30
- Versions concernées
- <1.74.4
- Type
- Bibliothèque
- Dernière modification
- 2026-08-25 17:18:18
- Vecteur
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N