CVSS 4.0
5.4 mediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:LCVE-2024-52522
Medium (5.4). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/rclone/rclone 1.68.2.
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-59, CWE-61, CWE-281
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hrxh-9w67-g4cv | Go | github.com/rclone/rclone | >=1.59.0 <1.68.2 | 1.68.2 |
| GO-2024-3271 | Go | github.com/rclone/rclone | >=1.59.0 <1.68.2 | 1.68.2 |