CVE-2026-59732

Modified Modified - Updated After Analysis

Path Traversal in Rclone Archive Extraction

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-59732

Affected Vendors & Products

Vendor	Product	Version / Range
rclone	rclone	to 1.74.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Rclone before 1.74.4 has a vulnerability where extracting archives can write files outside the intended destination due to improper handling of parent path components like ../. This allows overwriting or creating files in unintended locations within the same bucket or path scope.

Detection Guidance

To detect this vulnerability, check the version of rclone installed on your system. Run: rclone version. If the version is below 1.74.4, the system is vulnerable. Additionally, review any archives being extracted for parent path components like ../ that could write outside the intended destination.

Impact Analysis

This vulnerability could allow an attacker to overwrite or create files in unintended locations, potentially leading to data corruption, unauthorized access, or disruption of services if exploited through a crafted archive.

Compliance Impact

This vulnerability may impact compliance by enabling unauthorized file modifications or access, which could violate data integrity and confidentiality requirements under GDPR or HIPAA if sensitive data is involved.

Mitigation Strategies

Upgrade rclone to version 1.74.4 or later immediately. Avoid extracting untrusted archives until the update is applied. If immediate upgrade is not possible, avoid using rclone archive extract on untrusted files.

Hi! I’m here to help you understand CVE-2026-59732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70