DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59732: CVE-2026-59732: Path Traversal (Zip Slip) Vulnerability in rclone archive extract

#security #cve #cybersecurity

CVE-2026-59732: Path Traversal (Zip Slip) Vulnerability in rclone archive extract

Vulnerability ID: CVE-2026-59732
CVSS Score: 5.0
Published: 2026-08-05

A path traversal vulnerability (Zip Slip variant) exists in rclone's archive extract functionality before version 1.74.4. The command fails to sanitize relative directory components in archive headers, allowing files to be written outside the target directory or cloud prefix. This issue can result in arbitrary file writes or cloud object overwrites depending on the permissions of the credentials used. Nick Craig-Wood authored the patch on June 29, 2026, which was released in version 1.74.4 on July 14, 2026. This vulnerability is assigned CVE-2026-59732 and is cataloged as GHSA-4vr5-p2gc-h23p. This report provides a detailed root cause analysis, code-level diff, and remediation steps.

TL;DR

Unsanitized path extraction in rclone allows directory traversal and arbitrary file overwrite.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Local (AV:L)
  • CVSS Score: 5.0 (Medium)
  • EPSS Score: 0.00213 (Percentile: 11.63%)
  • Impact: Integrity and Availability (Partial)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • rclone
  • rclone: < 1.74.4 (Fixed in: 1.74.4)

Code Analysis

Commit: 1a74673

Secure path-validation helper function destPath introduced to clean and validate archive paths before extraction

Commit: d11efe0

Cherry-picked fix for path traversal vulnerability to stable branch v1.74.4

Exploit Details

  • GitHub: Vulnerability testing logic and unit tests validating path traversal patterns in cmd/archive/archive_test.go

Mitigation Strategies

  • Upgrade rclone to version 1.74.4 or later
  • Enforce IAM least privilege on S3 buckets using prefix-based access controls
  • Isolate rclone execution in containerized environments with limited mounts

Remediation Steps:

  1. Identify all deployed instances of rclone across automation pipelines, containers, and developer environments.
  2. Upgrade instances to version 1.74.4 or above.
  3. Verify the upgrade using the command 'rclone version'.
  4. Configure IAM policies to restrict cloud credentials to specific prefixes.

References

Read the full report for CVE-2026-59732 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)