THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-945v-v9p3-v5xw (low) — rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

[GHSA] GHSA-945v-v9p3-v5xw (low) — rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

highgithub_advisoriesPublished 2026-08-05

GHSA-945v-v9p3-v5xw Severity: low CVE: None

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

### Summary When writing an object with metadata, the local backend applies the source-supplied `mode`, `uid`, and `gid` verbatim: it parses `mode` as an octal integer and passes it straight into `os.Chmod(o.path, os.FileMode(umode))`, and pa

Indicators of compromise

Original source: https://github.com/advisories/GHSA-945v-v9p3-v5xw