CVE-2026-88014
Received Received - Intake

Path Traversal in Rclone Archive ZIP Backend

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88014
EUVD
EUVD-2026-75574

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rclone rclone From 1.72.0 (inc) to 1.75.1 (exc)
rclone rclone 1.75.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88014 is a Zip Slip vulnerability in rclone affecting versions 1.72.0 to 1.75.1. It allows malicious ZIP archives to write files outside the intended destination directory due to improper path sanitization. The archive/zip backend does not validate entry names, so crafted paths like ../../etc/cron.d/evil can bypass path.Clean and be used by rclone copy or sync commands to write files outside the target directory.

Detection Guidance

Check if your rclone version is between 1.72.0 and 1.75.0 by running rclone version. If affected, update to 1.75.1 or later. Inspect any recently mounted ZIP files for suspicious paths containing excessive .. components or unexpected directory traversals.

Impact Analysis

If you use rclone to copy or sync untrusted ZIP files, an attacker could craft a malicious archive that writes files to unintended locations on your system. This could overwrite system files, create backdoors, or place malware in sensitive directories. The impact depends on the backend's confinement but could lead to data corruption or unauthorized file access.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized file access or modification. For GDPR, it may lead to data breaches or unauthorized processing. For HIPAA, it could expose protected health information to unauthorized changes. Organizations using rclone to handle sensitive data must ensure proper controls to mitigate this risk.

Mitigation Strategies

Immediately upgrade rclone to version 1.75.1 or later. Avoid mounting or copying untrusted ZIP files until updated. If you must handle untrusted archives, use a sandboxed environment and validate file paths before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart