Rclone versions prior to 1.74.4 contain a vulnerability in the archive extract feature that allows extracted files to be written outside the intended destination prefix. This occurs when extracting crafted archives with parent path components like '../', enabling potential creation or overwrite of sibling objects in the same bucket or path scope. The issue is fixed in version 1.74.4.