CVE-2026-79783

LowCVSS 3.6/10Last modified Sep 10, 2026

Description

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-797848.8Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained CVE-2026-797855.9X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py b CVE-2026-797867.1Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, all CVE-2026-797879.8Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers CVE-2026-797887.1In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`CVE-2026-79794.3Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a craf CVE-2026-797925.6A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anythin CVE-2026-797934.3A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2026-797949.1A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker CVE-2026-797969.8Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated r CVE-2026-797978.8An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where applica CVE-2026-797989.9SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated r