rclone archive extract allows S3 destination prefix escape via crafted archive paths

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-59732 · CVE overview and exploitation status

EUVD-2026-44530

GHSA-4vr5-p2gc-h23p

BIT-rclone-2026-59732

GO-2026-6185

cve-program · CVE-2026-59732

• https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p
• https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c
• https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d
• https://github.com/rclone/rclone/releases/tag/v1.74.4

euvd · EUVD-2026-44530

• https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p
• https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c
• https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d
• https://github.com/rclone/rclone/releases/tag/v1.74.4

nvd · CVE-2026-59732

• https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c
• https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d
• https://github.com/rclone/rclone/releases/tag/v1.74.4
• https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p

osv · GHSA-4vr5-p2gc-h23p

• https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p
• https://nvd.nist.gov/vuln/detail/CVE-2026-59732
• https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c
• https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d
• https://github.com/rclone/rclone
• https://github.com/rclone/rclone/releases/tag/v1.74.4

osv · GO-2026-6185

• https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p
• https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c
• https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d
• https://github.com/rclone/rclone/releases/tag/v1.74.4

• Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a c… · Advisory content revised · 15 Nov 2026