VDB
GHSA-945v-v9p3-v5xw
GHSA-945v-v9p3-v5xw
PUBLISHED
CVSS 3.5999999046325684 LOW
rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote
Risk Scores
CVSS 3.1
3.5999999046325684
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | telegraf-1.38 | 0 |
| github.com | rclone/rclone | 0 |
| chainguard | telegraf-1.39 | 0 |
| chainguard | telegraf-1.38 | 0 |
Timeline
- Aug 5, 2026 CVE Published
- Aug 27, 2026 CVE Updated
References
- https://github.com/advisories/GHSA-945v-v9p3-v5xw advisory
- https://github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw url
- https://github.com/rclone/rclone/commit/e58f09739a35774ca82b5211d2377ac0f2051500 patch
- https://github.com/rclone/rclone/releases/tag/v1.74.4 url
- https://github.com/rclone/rclone package