CyberRota Analysis
AI-GeneratedRclone versions prior to 1.75.1 are vulnerable to a denial-of-service condition when using symlink targets with the backend/local option, as an unchecked Range start can lead to a panic during HTTP or WebDAV requests. This vulnerability could allow an attacker to disrupt service at the request level, impacting availability for users. Organizations utilizing rclone for file synchronization should prioritize upgrading to version 1.75.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.