{"id":"CVE-2026-88014","title":"rclone is a command-line program to sync files and directories to and from different cloud storage providers","summary":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.N…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","cwe":["CWE-22"],"vendor":"rclone","product":"rclone","affected":["rclone >= 1.72.0, < 1.75.1"],"patched":["rclone 1.75.1"],"published":"2026-09-10","updated":"2026-09-23","sourceUpdated":"2026-09-23T20:39:36.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88014","references":[{"url":"https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/releases/tag/v1.75.1","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q","label":"security-advisories@github.com"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88014"},{"url":"https://github.com/rclone/rclone"}],"tags":["nvd","osv","go","cve.org"],"epss":0.0014,"epssPercentile":0.03729,"aliases":["GHSA-66hp-wgxq-6f5q","BIT-rclone-2026-88014","GO-2026-6464"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T16:05:22.070564Z"},"ingestedAt":"2026-09-11T14:42:19.870Z","slug":"CVE-2026-88014","body":"## Overview\n\nrclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.\n\n## Affected\n\n- `rclone >= 1.72.0, < 1.75.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rclone 1.75.1`\n\n## Package advisory (CVE-2026-88014)\n\nAffected packages:\n\n- `github.com/rclone/rclone >= 1.72.0, < 1.75.1`\n\nPatched in:\n\n- `github.com/rclone/rclone 1.75.1`\n\nSource: https://osv.dev/vulnerability/GHSA-66hp-wgxq-6f5q","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}