CVE-2026-59732CWE-22

rclone archive extract allows S3 destination prefix escape via crafted archive paths

Medium · published July 14, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-14T21:36Z
EPSS history
Timeline
  • 14 JUL 21:36Z
    rclone archive extract allows S3 destination prefix escape via crafted archive paths
    cvelistv5