Executive brief
rclone's zip file mounting feature (`backend/archive`) allows users to browse and copy files from zip archives. A maliciously crafted zip file with specially crafted entry names can bypass path validation, allowing an attacker to write files outside the intended destination directory when a user performs a copy or sync operation. This could lead to unauthorized file placement on the target storage backend, potentially compromising system integrity or sensitive directories.
Technical details
The vulnerability is a path traversal (Zip Slip) weakness in rclone's zip backend located in `backend/archive/zip/zip.go`. The `readZip()` function applies `path.Clean()` to zip entry names from untrusted archives, but this alone is insufficient to prevent escape when entry names contain more `..` components than preceding path segments (e.g., `../../etc/cron.d/evil`). When mounting with an empty root (the common case), there was no validation that cleaned paths remained within the archive namespace. Additionally, an existing root filter used weak string prefix matching without boundary checks. The `fs/sync` and `fs/operations` modules directly use `Object.Remote()` as the destination path during copy/sync operations, enabling a malicious zip to write files outside the intended destination. Attack requires only a crafted zip file and a normal `rclone copy`/`sync`/`mount` invocation by the user; no authentication or special configuration is needed. The fix skips any zip entry whose cleaned+prefixed name still escapes the archive namespace and improves the root filter boundary checking.
Affected products
- rclone rclone >=1.72.0, <1.75.1
Timeline
- 2026-09-04: disclosed
- 2026-09-10: patched: Version 1.75.1 released