{"uuid": "1cc6f9bb-61c2-4f2c-a276-5852a093804f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4vr5-p2gc-h23p", "type": "seen", "source": "https://gist.github.com/alon710/7cd2b59244b6ec677e9295bd453cf08b", "content": "# CVE-2026-59732: CVE-2026-59732: Path Traversal (Zip Slip) Vulnerability in rclone archive extract\n\n> **CVSS Score:** 5.0\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59732\n\n## Summary\nA path traversal vulnerability (Zip Slip variant) exists in rclone's archive extract functionality before version 1.74.4. The command fails to sanitize relative directory components in archive headers, allowing files to be written outside the target directory or cloud prefix. This issue can result in arbitrary file writes or cloud object overwrites depending on the permissions of the credentials used. Nick Craig-Wood authored the patch on June 29, 2026, which was released in version 1.74.4 on July 14, 2026. This vulnerability is assigned CVE-2026-59732 and is cataloged as GHSA-4vr5-p2gc-h23p. This report provides a detailed root cause analysis, code-level diff, and remediation steps.\n\n## TL;DR\nUnsanitized path extraction in rclone allows directory traversal and arbitrary file overwrite.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Local (AV:L)\n- **CVSS Score**: 5.0 (Medium)\n- **EPSS Score**: 0.00213 (Percentile: 11.63%)\n- **Impact**: Integrity and Availability (Partial)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- rclone\n- **rclone**: < 1.74.4 (Fixed in: `1.74.4`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.74.4 or later\n- Enforce IAM least privilege on S3 buckets using prefix-based access controls\n- Isolate rclone execution in containerized environments with limited mounts\n\n**Remediation Steps:**\n1. Identify all deployed instances of rclone across automation pipelines, containers, and developer environments.\n2. Upgrade instances to version 1.74.4 or above.\n3. Verify the upgrade using the command 'rclone version'.\n4. Configure IAM policies to restrict cloud credentials to specific prefixes.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p)\n- [Core Fix Commit (Main)](https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c)\n- [Cherry-Picked Fix Commit (Stable)](https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d)\n- [rclone v1.74.4 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n- [NVD CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-59732)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-59732)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59732) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T07:31:27.662468Z"}