{"cve":"CVE-2026-88014","nvd":{"published":"2026-09-10T16:18:08.350","modified":"2026-09-23T20:39:36.190","status":"Analyzed","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","score":6.3},"cwes":["CWE-22"],"references":["https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0","https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98","https://github.com/rclone/rclone/releases/tag/v1.75.1","https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q","https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q"],"products":["rclone:rclone"],"source":"nvd","synced_at":"2026-10-19T22:52:53.108888569+00:00"},"epss":{"cve":"CVE-2026-88014","score":0.00151,"percentile":0.04201,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-66hp-wgxq-6f5q","url":"https://osv.dev/vulnerability/GHSA-66hp-wgxq-6f5q","summary":"rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace","modified":"2026-09-19T09:25:51.754250711Z","packages":[{"ecosystem":"Go","name":"github.com/rclone/rclone","purl":"pkg:golang/github.com/rclone/rclone","ranges":[">=1.72.0 <1.75.1"],"fixed":["1.75.1"]}]},{"id":"GO-2026-6464","url":"https://osv.dev/vulnerability/GO-2026-6464","summary":"rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone","modified":"2026-09-19T09:25:51.754250711Z","packages":[{"ecosystem":"Go","name":"github.com/rclone/rclone","purl":"pkg:golang/github.com/rclone/rclone","ranges":[">=1.72.0 <1.75.1"],"fixed":["1.75.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}