Executive brief
rclone is a command-line program used to manage files on cloud storage. A vulnerability in its archive extraction feature allows a specially crafted archive file to write data to unintended locations on S3-compatible cloud storage. If a user extracts a malicious archive, an attacker could overwrite or create files outside the specified folder, potentially leading to data corruption or unauthorized file placement.
Technical details
A path traversal vulnerability (CWE-22) exists in the `rclone archive extract` command within `cmd/archive/extract/extract.go`. The application fails to properly sanitize archive entry paths, specifically failing to reject or neutralize parent directory components like `../` before joining them with the destination directory using `path.Join()`. When the destination is an S3-style remote, this allows an attacker to escape the intended destination prefix and write or overwrite objects in sibling directories within the same bucket. Exploitation requires a victim to extract a malicious archive provided by the attacker. The issue is fixed in version 1.74.4.
Affected products
- rclone rclone <= 1.74.3
Timeline
- 2026-07-08: disclosed
- 2026-07-14: advisory: NVD publication
- 2026-08-05: patched: GitHub Advisory published/updated