Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rclone/rclone | go | <= 1.75.0 | 1.75.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-88015, in rclone's backend/local component, specifically affects how Range requests are handled for translated symlinks when the --links option is enabled. The core issue is an unchecked offset value derived from a client-supplied Range header. When this offset is excessively large, it leads to an out-of-bounds slice access in the openTranslatedLink function, causing a 'slice bounds out of range' panic and a Denial of Service.
My analysis focused on the provided commit 28bf49d66f94acc3f4f7f318504a706686281af9, which contains the fix. The patch clearly shows modifications to the openTranslatedLink function in backend/local/local.go. Before the fix, the line linkdst[offset:] directly used the offset without any validation against the length of linkdst. The patch introduces explicit clamping logic: if offset < 0 { offset = 0 } and if offset > int64(len(linkdst)) { offset = int64(len(linkdst)) } to ensure offset remains within valid bounds.
Additionally, the vulnerability description and the provided Proof of Concept (PoC) stack trace indicate that Object.Open() is the function that decodes the RangeOption and subsequently calls openTranslatedLink. Therefore, Object.Open() is also identified as a vulnerable function because it processes the malicious input and passes it to the directly vulnerable openTranslatedLink without adequate sanitization or validation of the offset value. Both functions would appear in a runtime profiler during exploitation, with Object.Open initiating the process and openTranslatedLink being the site of the crash.
backend/local.(*Object).openTranslatedLinkbackend/local/local.go
backend/local.(*Object).Openbackend/local/local.go