CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

• CWE-22

• https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0
• https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98
• https://github.com/rclone/rclone/releases/tag/v1.75.1
• https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q
• https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q

Published

Sep 10, 2026

Last Modified

Sep 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88008Traefik is an open source HTTP reverse proxy and load balanc…7
• CVE-2026-88009Traefik is an open source HTTP reverse proxy and load balanc…8.8
• CVE-2026-8801Path equivalence: vulnerability in Progress MOVEit Transfer …9.8
• CVE-2026-88011Traefik is an open source HTTP reverse proxy and load balanc…5.3
• CVE-2026-88012Traefik is an open source HTTP reverse proxy and load balanc…5.3
• CVE-2026-88013rclone is a command-line program to sync files and directori…3.7
• CVE-2026-88015rclone is a command-line program to sync files and directori…5.3
• CVE-2026-88016rclone is a command-line program to sync files and directori…7.1
• CVE-2026-88017rclone is a command-line program to sync files and directori…7.3
• CVE-2026-88018rclone is a command-line program to sync files and directori…9.8
• CVE-2026-8802A vulnerability was detected in opensourcepos Open Source Po…5.3
• CVE-2026-88021Consul and Consul Enterprise are vulnerable to an authorizat…7.1