Is CVE-2026-59732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59732 being exploited in the wild.

How severe is CVE-2026-59732?

Medium severity, with a CVSS score of 5, published 14 July 2026.

Which products and versions are affected?

github.com/rclone/rclone (Go) <= 1.74.3, SEMVER:introduced=0,fixed=1.74.4; Rclone < 1.74.4, <= 1.74.3.

Is there a fix for CVE-2026-59732?

Yes. github.com/rclone/rclone (Go): upgrade to 1.74.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59732 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-59732?

Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59732: rclone path traversal in archive extract

Q: Is there a fix for CVE-2026-59732?

Yes. github.com/rclone/rclone (Go): upgrade to 1.74.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59732 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-59732?

Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59732 · Severity: medium · CVSS 5 · Published 2026-07-14

rclone is a command-line program used to manage files on cloud storage. A vulnerability in its archive extraction feature allows a specially crafted archive file to write data to unintended locations on S3-compatible cloud storage. If a user extracts a malicious archive, an attacker could overwrite or create files outside the specified folder, potentially leading to data corruption or unauthorized file placement.

Technologies: github.com/rclone/rclone (Go), Rclone. Vendors: Go, Rclone.

Quick answers

Is CVE-2026-59732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59732 being exploited in the wild.
How severe is CVE-2026-59732?: Medium severity, with a CVSS score of 5, published 14 July 2026.
Which products and versions are affected?: github.com/rclone/rclone (Go) <= 1.74.3, SEMVER:introduced=0,fixed=1.74.4; Rclone < 1.74.4, <= 1.74.3.
Is there a fix for CVE-2026-59732?: Yes. github.com/rclone/rclone (Go): upgrade to 1.74.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59732 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-59732?: Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rclone/rclone (Go): upgrade to 1.74.4 or later
```
go get github.com/rclone/rclone@v1.74.4
```

Technical details

A path traversal vulnerability (CWE-22) exists in the `rclone archive extract` command within `cmd/archive/extract/extract.go`. The application fails to properly sanitize archive entry paths, specifically failing to reject or neutralize parent directory components like `../` before joining them with the destination directory using `path.Join()`. When the destination is an S3-style remote, this allows an attacker to escape the intended destination prefix and write or overwrite objects in sibling directories within the same bucket. Exploitation requires a victim to extract a malicious archive provided by the attacker. The issue is fixed in version 1.74.4.

Affected products

rclone rclone <= 1.74.3

Identifiers

CVE-2026-59732
GHSA-4vr5-p2gc-h23p
GO-2026-6185

Timeline

2026-07-08: disclosed
2026-07-14: advisory: NVD publication
2026-08-05: patched: GitHub Advisory published/updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.