rclone archive extract allows S3 destination prefix escape via crafted archive paths

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

Source published

14 Jul 2026 21:36:21 UTC

Source modified

21 Jul 2026 14:43:46 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 5.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

Source published

Jul 14, 2026, 9:36:21 PM (timezone not stated)

Source modified

Jul 21, 2026, 2:43:46 PM (timezone not stated)

Saved here

13 Nov 2026 16:02:38 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 5.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

Source published

14 Jul 2026 22:17:29 UTC

Source modified

21 Jul 2026 16:17:18 UTC

Saved here

25 Oct 2026 14:19:22 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 5.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

### Summary `rclone archive extract` can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as `../` can escape the requested extraction prefix and create or overwrite sibling objects in the same bucket/path scope. ### Details The affected code path is in `cmd/archive/extract/extract.go`. In `ArchiveExtract()`, the archive entry path is taken from `f.NameInArchive`. The code strips only a leading `./` prefix and then joins the archive entry path with the destination directory: ```go remote := f.NameInArchive remote = strings.TrimPrefix(remote, "./") if dstDir != "" { remote = path.Join(dstDir, remote) } _, err = operations.Rcat(ctx, dst, remote, fin, f.ModTime(), nil) ``` Parent path components such as `../` are not rejected before `path.Join()` is used. When the destination is an S3-style remote such as: ```text :s3:bucket/safe/prefix ``` rclone creates the destination filesystem rooted at `bucket/safe` and treats `prefix` as the destination directory. If the archive contains an entry named: ```text ../escaped-from-prefix.txt ``` then `path.Join("prefix", "../escaped-from-prefix.txt")` resolves to: ```text escaped-from-prefix.txt ``` As a result, the S3 backend uploads the object to: ```text bucket/safe/escaped-from-prefix.txt ``` instead of the expected destination: ```text bucket/safe/prefix/escaped-from-prefix.txt ``` This allows an attacker-controlled archive to escape the selected extraction prefix on object-storage remotes. ### PoC Test environment: - Windows 11 - rclone v1.74.3 official Windows amd64 binary - Local fake S3 HTTP endpoint - Crafted ZIP archive containing `../escaped-from-prefix.txt` Steps to reproduce:https://drive.google.com/file/d/1P_cLKFgiWSVSATB8500yP28jdzwt9FAt/view?usp=sharing 1. Extract the attached PoC ZIP. 2. Run the PoC script: ```powershell powershell -ExecutionPolicy Bypass -File .\run-poc.ps1 -RcloneExe "C:\path\to\rclone.exe" ``` 3. The PoC creates a ZIP archive containing this entry: ```text ../escaped-from-prefix.txt ``` 4. The PoC starts a local fake S3 endpoint and runs rclone with an S3-style destination prefix: ```powershell rclone archive extract malicious.zip :s3:bucket/safe/prefix ``` 5. Observe the fake S3 request log. Expected safe behavior: ```text PUT /bucket/safe/prefix/escaped-from-prefix.txt ``` Observed behavior: ```text PUT /bucket/safe/escaped-from-prefix.txt?x-id=PutObject ``` This shows that the archive entry escaped the requested `safe/prefix` destination and was written under `safe/` instead. The PoC package includes: - `run-poc.ps1` - `fake-s3-server.py` - `README.md` - `report-draft.md` - captured proof logs ### Impact An attacker who supplies an archive that a victim extracts with `rclone archive extract` can cause extracted files to be written outside the destination prefix selected by the victim when the destination is an S3-style object storage remote. Depending on the victim's configured remote credentials and bucket permissions, this may allow creation or overwrite of sibling objects outside the intended extraction directory/prefix. This does not require compromising the S3 service itself. The attack relies on the victim extracting an attacker-controlled archive with rclone into an object-storage prefix.

Source published

5 Aug 2026 20:43:47 UTC

Source modified

10 Sep 2026 03:50:53 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Publisher rating · MODERATE

Path traversal via crafted archive paths in github.com/rclone/rclone

Source published

18 Aug 2026 16:38:10 UTC

Source modified

18 Aug 2026 17:23:53 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.