Rclone is a command-line program to sync files and directories to and from different cloud storage providers. (CVE-2026-59732)

Rclone, a command-line tool for syncing files with cloud storage providers, has a vulnerability (CVE-2026-59732) in versions prior to 1.74.4. The flaw exists in the archive extract functionality where crafted archives containing parent path components ('../') can cause files to be written outside the intended destination prefix, specifically allowing escape from the designated S3 destination prefix. This enables attackers to create or overwrite sibling objects within the same bucket or path scope. The vulnerability is addressed and fixed in version 1.74.4.

The vulnerability allows an attacker to write files outside the intended destination prefix when extracting archives, potentially leading to unauthorized creation or overwriting of objects within the same S3 bucket or path scope. This could impact data integrity and availability within the affected storage environment. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

A fix is available in Rclone version 1.74.4. Users should upgrade to version 1.74.4 or later to remediate this vulnerability. No additional mitigation actions are indicated by the vendor advisory.