CVE-2026-88014: CVE-2026-88014: Path Traversal (Zip Slip) and Directory Boundary Bypass in rclone ZIP Backend

#security #cve #cybersecurity

CVE-2026-88014: Path Traversal (Zip Slip) and Directory Boundary Bypass in rclone ZIP Backend

Vulnerability ID: CVE-2026-88014
CVSS Score: 6.3
Published: 2026-09-10

A critical path traversal vulnerability (commonly known as 'Zip Slip') exists in rclone's ZIP archive backend implementation (backend/archive/zip/zip.go) between versions 1.72.0 and 1.75.1. The flaw allows an attacker to write arbitrary files outside the designated extraction directory by supplying a maliciously crafted ZIP archive. Additionally, the backend's directory boundary verification routine failed to enforce strict path limits, causing sibling folders sharing a name prefix to match incorrectly and leading to unauthorized data exposure. This issue has been fully resolved in version 1.75.1.

TL;DR

Unsanitized ZIP entry names allow directory traversal (Zip Slip) and sibling folder data exposure in rclone's ZIP backend.

Technical Details

CWE ID: CWE-22
Attack Vector: Local (AV:L)
CVSS Score: 6.3
EPSS Score: Not Populated
Exploit Status: PoC (unit tests available)
KEV Status: No
Impact: Arbitrary File Write / Path Traversal

Affected Systems

rclone installations utilizing the ZIP backend between versions 1.72.0 and 1.75.0

Mitigation Strategies

Upgrade rclone to version 1.75.1 or newer
Sandbox the execution context using AppArmor, SELinux, or Docker boundaries
Run rclone under a low-privilege service account to restrict filesystem write capability

Remediation Steps:

Verify current rclone installation via 'rclone version'
Download the latest release package from the official source
Replace the existing rclone binary with version 1.75.1 or later
Ensure backup scripts and automated jobs utilize the updated binary

References

Read the full report for CVE-2026-88014 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community