CVE-2024-52522: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata
Vulnerability summary
CVE-2024-52522 is a medium (CVSS 5.4) vulnerability in rclone. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities.
Not severe (CVSS 5.4, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 15-11-2024PublishedVulnerability first disclosed.
- 21-11-2024Last modifiedVulnerability information updated.
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
CVSS metrics
9 scores · 8 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- OSV · GoEcosystem advisory · calculated5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- NVDNIST5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated5.4MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-59Improper Link Resolution Before File AccessThe product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
- CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
- CWE-281Improper Preservation of PermissionsThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Affected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- rclone< 1.68.2-r0
Chainguard1 product
- rclone< 1.68.2-r0
Debian1 product
- rcloneAll versions (No fix recorded)
Github.com/rclone1 product
- rclone≥ 1.59.0, < 1.68.2
Opensuse1 product
- rclone&distro=openSUSE Tumbleweed< 1.68.2-2.1
Rclone1 product
- rclone≥ 1.59.0, < 1.68.2
Ubuntu1 product
- rcloneAll versions (No fix recorded)
Wolfi1 product
- rclone< 1.68.2-r0
8 vendors · 8 products
References
12 links- github.com/rclone/rclone/security/advisories/GHSA-hrxh-9w67-g4cvX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/rclone/rclone/commit/01ccf204f42b4f68541b16843292439090a2dcf0X Refsource MISCREPORTFIXWEB
- github.com/rclone/rclonePACKAGE
- lists.opensuse.org/archives/…Advisory