High [CVE-2026-54572] Arbitrary file write via malicious symbolic link handling

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Prior to 1.74.4, with -l/--links, rclone serializes symlinks as.rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents.

This issue is fixed in version 1.74.4. A remote attacker could exploit this by providing a malicious symlink, allowing subsequent file writes to occur outside the intended destination with content chosen by the attacker.

This could lead to unauthorized modification of files on the system. Rclone's -l/--links option serializes symbolic links encountered during a sync as `.rclonelink` text objects containing the link target, and later recreates those links on the destination.

Prior to 1.74.4, rclone did not validate that a stored link target stays within the intended destination tree before recreating it.

A remote storage backend under an attacker's control can therefore supply a crafted `.rclonelink` object whose target escapes the destination directory (e.g. via a `../` traversal or an absolute path), causing a subsequent write during the same or a later sync to be redirected outside the intended destination with attacker-chosen content.