# CVE-2026-59732: rclone path traversal in archive extract

Source: https://junglewise.ai/threats/cve-2026-59732-rclone-path-traversal-in-archive-extract  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-59732 · Severity: medium · CVSS 5 · Published 2026-07-14

rclone is a command-line program used to manage files on cloud storage. A vulnerability in its archive extraction feature allows a specially crafted archive file to write data to unintended locations on S3-compatible cloud storage. If a user extracts a malicious archive, an attacker could overwrite or create files outside the specified folder, potentially leading to data corruption or unauthorized file placement.

Technologies: [github.com/rclone/rclone (Go)](https://junglewise.ai/threats/technologies/github-com-rclone-rclone), [Rclone](https://junglewise.ai/threats/technologies/rclone). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Rclone](https://junglewise.ai/threats/vendors/rclone).

## Quick answers

**Is CVE-2026-59732 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59732 being exploited in the wild.

**How severe is CVE-2026-59732?** Medium severity, with a CVSS score of 5, published 14 July 2026.

**Which products and versions are affected?** github.com/rclone/rclone (Go) <= 1.74.3, SEMVER:introduced=0,fixed=1.74.4; Rclone < 1.74.4, <= 1.74.3.

**Is there a fix for CVE-2026-59732?** Yes. github.com/rclone/rclone (Go): upgrade to 1.74.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59732 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-59732?** Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rclone/rclone (Go): upgrade to 1.74.4 or later

  ```sh
  go get github.com/rclone/rclone@v1.74.4
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in the `rclone archive extract` command within `cmd/archive/extract/extract.go`. The application fails to properly sanitize archive entry paths, specifically failing to reject or neutralize parent directory components like `../` before joining them with the destination directory using `path.Join()`. When the destination is an S3-style remote, this allows an attacker to escape the intended destination prefix and write or overwrite objects in sibling directories within the same bucket. Exploitation requires a victim to extract a malicious archive provided by the attacker. The issue is fixed in version 1.74.4.

## Affected products

- rclone rclone <= 1.74.3

## Identifiers

- CVE-2026-59732
- GHSA-4vr5-p2gc-h23p
- GO-2026-6185

## Timeline

- 2026-07-08: disclosed
- 2026-07-14: advisory: NVD publication
- 2026-08-05: patched: GitHub Advisory published/updated

## References

- [https://api.github.com/users/Dangel165](https://api.github.com/users/Dangel165)
- [https://github.com/Dangel165](https://github.com/Dangel165)
- [https://api.github.com/users/Dangel165/gists%7B/gist_id%7D](https://api.github.com/users/Dangel165/gists%7B/gist_id%7D)
- [https://api.github.com/users/Dangel165/repos](https://api.github.com/users/Dangel165/repos)
- [https://avatars.githubusercontent.com/u/180247239?v=4](https://avatars.githubusercontent.com/u/180247239?v=4)
- [https://api.github.com/users/Dangel165/events%7B/privacy%7D](https://api.github.com/users/Dangel165/events%7B/privacy%7D)

## Related threats

- [Rclone B2 backend credential exposure on HTTP redirects](https://junglewise.ai/threats/cve-2026-116196-rclone-before-v1-75-2-contains-a-credential-exposure)
- [Rclone path traversal in translateLink function](https://junglewise.ai/threats/cve-2026-116195-rclone-before-1-75-2-contains-a-path-traversal-vulnerability-in)
- [Rclone cross-site request forgery in pCloud OAuth callback](https://junglewise.ai/threats/cve-2026-116194-rclone-from-1-52-0-before-1-75-2-contains-a-cross-site-request)
- [Rclone serve webdav authentication bypass via OPTIONS requests](https://junglewise.ai/threats/cve-2026-116193-rclone-from-1-64-0-before-1-75-2-contains-an-authentication)
- [rclone server-side request forgery via --rc-serve scheme-relative roots](https://junglewise.ai/threats/cve-2026-116192-rclone-from-1-37-before-1-74-2-contains-a-server-side-request)