MEDIUM 5.0 GitHub
CVE-2026-59732
rclone archive extract allows S3 destination prefix escape via crafted archive paths
### Summary
`rclone archive extract` can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as `../` can escape the requested extraction prefix and create or overwrite sibling objects in the same bucket/path scope.
### Details
The affected code path is in `cmd/archive/extract/extract.go`.
In `ArchiveExtract()`, the archive entry path is taken from `f.NameInArchive`. The code st
Affected Products
- go/github.com/rclone/rclone <= 1.74.3
References
- https://github.com/advisories/GHSA-4vr5-p2gc-h23p
- https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p
- https://nvd.nist.gov/vuln/detail/CVE-2026-59732
- https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c
This medium severity vulnerability with a CVSS score of 5.0 was published on 2026-08-05 via GitHub. Affected: go/github.com/rclone/rclone <= 1.74.3.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.