CVE-2026-79783 — rclone before 1.74.4 Privilege Escalation via setuid Metadata
rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on atta…
Published: 2026-08-25 · CVSS: 2.0 · CVSS 4.0
rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7