rclone archive extract allows S3 destination prefix escape via crafted archive paths (CVE-2026-59732)
Rclone versions prior to 1.74.4 have a vulnerability in the archive extract functionality that allows writing files outside the intended destination prefix. This occurs when extracting crafted archives containing parent path components such as '../', enabling escape from the designated S3 destination prefix. The issue allows creation or overwriting of sibling objects within the same bucket or path scope. The vulnerability is fixed in version 1.74.4.
AI Analysis
Technical Summary
Rclone, a command-line tool for syncing files with cloud storage providers, has a path traversal vulnerability (CVE-2026-59732) in its archive extract feature prior to version 1.74.4. When extracting archives with crafted paths containing parent directory references (e.g., '../'), the tool can write files outside the user-specified destination prefix on S3-compatible storage. This allows an attacker to create or overwrite objects outside the intended directory scope within the same bucket. The vulnerability is addressed by patches committed in version 1.74.4.
Potential Impact
An attacker who can supply a crafted archive to rclone's archive extract function can cause files to be written outside the intended destination prefix on S3 storage. This can lead to unauthorized creation or overwriting of sibling objects in the same bucket or path scope, potentially impacting data integrity and confidentiality within that storage environment.
Mitigation Recommendations
Upgrade rclone to version 1.74.4 or later, where this vulnerability is fixed. The vendor has released official patches addressing this issue. No additional mitigation is required once the update is applied.
rclone archive extract allows S3 destination prefix escape via crafted archive paths (CVE-2026-59732)
Description
Rclone versions prior to 1.74.4 have a vulnerability in the archive extract functionality that allows writing files outside the intended destination prefix. This occurs when extracting crafted archives containing parent path components such as '../', enabling escape from the designated S3 destination prefix. The issue allows creation or overwriting of sibling objects within the same bucket or path scope. The vulnerability is fixed in version 1.74.4.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rclone, a command-line tool for syncing files with cloud storage providers, has a path traversal vulnerability (CVE-2026-59732) in its archive extract feature prior to version 1.74.4. When extracting archives with crafted paths containing parent directory references (e.g., '../'), the tool can write files outside the user-specified destination prefix on S3-compatible storage. This allows an attacker to create or overwrite objects outside the intended directory scope within the same bucket. The vulnerability is addressed by patches committed in version 1.74.4.
Potential Impact
An attacker who can supply a crafted archive to rclone's archive extract function can cause files to be written outside the intended destination prefix on S3 storage. This can lead to unauthorized creation or overwriting of sibling objects in the same bucket or path scope, potentially impacting data integrity and confidentiality within that storage environment.
Mitigation Recommendations
Upgrade rclone to version 1.74.4 or later, where this vulnerability is fixed. The vendor has released official patches addressing this issue. No additional mitigation is required once the update is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-rclone-2026-59732
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-59732"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Patch Information
Threat ID: 6aa005c7acd9273b49ab5c72
Added to database: 09/08/2026, 12:55:35 UTC
Last enriched: 09/08/2026, 13:20:47 UTC
Last updated: 09/08/2026, 22:52:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.