---
id: CVE-2026-88014
title: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers
summary: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP
  backend method (*Fs).readZip in backend/archive/zip/zip.go accepts
  archive/zip.File.N…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N'
cwe:
  - CWE-22
vendor: rclone
product: rclone
affected:
  - 'rclone >= 1.72.0, < 1.75.1'
patched:
  - rclone 1.75.1
published: '2026-09-10'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:39:36.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88014'
references:
  - url: >-
      https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0
    label: security-advisories@github.com
  - url: >-
      https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.75.1'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88014'
  - url: 'https://github.com/rclone/rclone'
tags:
  - nvd
  - osv
  - go
  - cve.org
epss: 0.0014
epssPercentile: 0.03729
aliases:
  - GHSA-66hp-wgxq-6f5q
  - BIT-rclone-2026-88014
  - GO-2026-6464
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T16:05:22.070564Z'
ingestedAt: '2026-09-11T14:42:19.870Z'
---

## Overview

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

## Affected

- `rclone >= 1.72.0, < 1.75.1`

## Remediation

Upgrade past the affected range:

- `rclone 1.75.1`

## Package advisory (CVE-2026-88014)

Affected packages:

- `github.com/rclone/rclone >= 1.72.0, < 1.75.1`

Patched in:

- `github.com/rclone/rclone 1.75.1`

Source: https://osv.dev/vulnerability/GHSA-66hp-wgxq-6f5q