CVE-2026-88014: rclone archive/zip Zip Slip path traversal

CVE-2026-88014 · Severity: medium · CVSS 6.3 · Published 2026-09-10

rclone's zip file mounting feature (`backend/archive`) allows users to browse and copy files from zip archives. A maliciously crafted zip file with specially crafted entry names can bypass path validation, allowing an attacker to write files outside the intended destination directory when a user performs a copy or sync operation. This could lead to unauthorized file placement on the target storage backend, potentially compromising system integrity or sensitive directories.

Technologies: github.com/rclone/rclone (Go), Rclone. Vendors: Go, Rclone.

Quick answers

Is CVE-2026-88014 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88014 being exploited in the wild.
How severe is CVE-2026-88014?
Medium severity, with a CVSS score of 6.3, published 10 September 2026.
Which products and versions are affected?
github.com/rclone/rclone (Go) >= 1.72.0, < 1.75.1, SEMVER:introduced=1.72.0,fixed=1.75.1; Rclone >=1.72.0, <1.75.1.
Is there a fix for CVE-2026-88014?
Yes. github.com/rclone/rclone (Go): upgrade to 1.75.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88014 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-88014?
Check whether you run github.com/rclone/rclone (Go) or Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/rclone/rclone (Go): upgrade to 1.75.1 or later
    go get github.com/rclone/rclone@v1.75.1

Technical details

The vulnerability is a path traversal (Zip Slip) weakness in rclone's zip backend located in `backend/archive/zip/zip.go`. The `readZip()` function applies `path.Clean()` to zip entry names from untrusted archives, but this alone is insufficient to prevent escape when entry names contain more `..` components than preceding path segments (e.g., `../../etc/cron.d/evil`). When mounting with an empty root (the common case), there was no validation that cleaned paths remained within the archive namespace. Additionally, an existing root filter used weak string prefix matching without boundary checks. The `fs/sync` and `fs/operations` modules directly use `Object.Remote()` as the destination path during copy/sync operations, enabling a malicious zip to write files outside the intended destination. Attack requires only a crafted zip file and a normal `rclone copy`/`sync`/`mount` invocation by the user; no authentication or special configuration is needed. The fix skips any zip entry whose cleaned+prefixed name still escapes the archive namespace and improves the root filter boundary checking.

Affected products

  • rclone rclone >=1.72.0, <1.75.1

Identifiers

  • CVE-2026-88014
  • GHSA-66hp-wgxq-6f5q
  • GO-2026-6464

Timeline

  • 2026-09-04: disclosed
  • 2026-09-10: patched: Version 1.75.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.