CVE-2026-88014

Name of the Vulnerable Software and Affected Versions rclone versions 1.72.0 through 1.75.0

Description The archive ZIP backend in rclone is susceptible to a Zip Slip (path traversal) issue. The (*Fs).readZip function in backend/archive/zip/zip.go processes file names from an untrusted ZIP central directory using path.Clean, but it fails to ensure that the resulting names remain within the archive namespace. This allows maliciously crafted entries, such as ../../etc/cron.d/evil, to be used as destination-relative paths by fs/sync and fs/operations. Consequently, an attacker can cause rclone copy or sync to write files outside the intended destination directory on backends that do not independently confine paths. Additionally, the root check implemented via strings.HasPrefix lacked a path boundary, potentially allowing sibling entries to be incorrectly included. This occurs when a user performs operations against an untrusted ZIP file.

Recommendations Update rclone to version 1.75.1. As a temporary mitigation, avoid using rclone copy, sync, or mount with untrusted ZIP files.