CVE-2026-79783

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4

Description The local backend fails to mask special permission bits when applying source-supplied mode metadata. This allows an attacker to set setuid or setgid bits on files they control. When copying files with metadata preservation from an untrusted remote source, an attacker can plant a setuid binary to escalate privileges to root if the process runs as root, or to the associated service account user.

Recommendations Update rclone to version 1.74.4 or later.