CVE-2026-88014: Rclone

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Affected products

• Rclone Rclone: from 1.72.0, before 1.75.1 (fixed in 1.75.1)

Published 2026-09-10. Last modified 2026-09-23.