CVE-2026-79783

Low

Description

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.

SeverityLow

CVSS3.6

Exploit probability—

ProductGithub.com/rclone/rclone

PublishedAug 25, 2026

First seenAug 25, 2026

Weakness typeCWE-732CWE-732

How to fix

Update

github.com/rclone/rclone1.74.4 or later

Vendor advisories

github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw

Affected products

Product	Affected versions	Fixed in
github.com/rclone/rcloneGo	v < 1.74.4	1.74.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.