CVE-2026-88014

What it is

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data tampering.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-10 16:18 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-23 20:39 UTC Last updatedMost recent change to the record

Details

Published

2026-09-10 16:18 UTC

Last modified

2026-09-23 20:39 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-22 · Path traversal

Record status

Analyzed

Affected

• Rclone < 1.75.1

Attack profile CVSS 3.1 · 6.3

Attack vector

Local

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None