{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.74.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rclone/rclone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.74.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T20:43:47Z",
    "nvd_published_at": "2026-07-14T22:17:29Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`rclone archive extract` can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as `../` can escape the requested extraction prefix and create or overwrite sibling objects in the same bucket/path scope.\n\n### Details\n\nThe affected code path is in `cmd/archive/extract/extract.go`.\n\nIn `ArchiveExtract()`, the archive entry path is taken from `f.NameInArchive`. The code strips only a leading `./` prefix and then joins the archive entry path with the destination directory:\n\n```go\nremote := f.NameInArchive\nremote = strings.TrimPrefix(remote, \"./\")\nif dstDir != \"\" {\n    remote = path.Join(dstDir, remote)\n}\n_, err = operations.Rcat(ctx, dst, remote, fin, f.ModTime(), nil)\n```\n\nParent path components such as `../` are not rejected before `path.Join()` is used.\n\nWhen the destination is an S3-style remote such as:\n\n```text\n:s3:bucket/safe/prefix\n```\n\nrclone creates the destination filesystem rooted at `bucket/safe` and treats `prefix` as the destination directory. If the archive contains an entry named:\n\n```text\n../escaped-from-prefix.txt\n```\n\nthen `path.Join(\"prefix\", \"../escaped-from-prefix.txt\")` resolves to:\n\n```text\nescaped-from-prefix.txt\n```\n\nAs a result, the S3 backend uploads the object to:\n\n```text\nbucket/safe/escaped-from-prefix.txt\n```\n\ninstead of the expected destination:\n\n```text\nbucket/safe/prefix/escaped-from-prefix.txt\n```\n\nThis allows an attacker-controlled archive to escape the selected extraction prefix on object-storage remotes.\n\n### PoC\n\nTest environment:\n\n- Windows 11\n- rclone v1.74.3 official Windows amd64 binary\n- Local fake S3 HTTP endpoint\n- Crafted ZIP archive containing `../escaped-from-prefix.txt`\n\nSteps to reproduce:https://drive.google.com/file/d/1P_cLKFgiWSVSATB8500yP28jdzwt9FAt/view?usp=sharing\n\n1. Extract the attached PoC ZIP.\n\n2. Run the PoC script:\n\n```powershell\npowershell -ExecutionPolicy Bypass -File .\\run-poc.ps1 -RcloneExe \"C:\\path\\to\\rclone.exe\"\n```\n\n3. The PoC creates a ZIP archive containing this entry:\n\n```text\n../escaped-from-prefix.txt\n```\n\n4. The PoC starts a local fake S3 endpoint and runs rclone with an S3-style destination prefix:\n\n```powershell\nrclone archive extract malicious.zip :s3:bucket/safe/prefix\n```\n\n5. Observe the fake S3 request log.\n\nExpected safe behavior:\n\n```text\nPUT /bucket/safe/prefix/escaped-from-prefix.txt\n```\n\nObserved behavior:\n\n```text\nPUT /bucket/safe/escaped-from-prefix.txt?x-id=PutObject\n```\n\nThis shows that the archive entry escaped the requested `safe/prefix` destination and was written under `safe/` instead.\n\nThe PoC package includes:\n\n- `run-poc.ps1`\n- `fake-s3-server.py`\n- `README.md`\n- `report-draft.md`\n- captured proof logs\n\n### Impact\n\nAn attacker who supplies an archive that a victim extracts with `rclone archive extract` can cause extracted files to be written outside the destination prefix selected by the victim when the destination is an S3-style object storage remote.\n\nDepending on the victim\u0027s configured remote credentials and bucket permissions, this may allow creation or overwrite of sibling objects outside the intended extraction directory/prefix.\n\nThis does not require compromising the S3 service itself. The attack relies on the victim extracting an attacker-controlled archive with rclone into an object-storage prefix.",
  "id": "GHSA-4vr5-p2gc-h23p",
  "modified": "2026-08-05T20:43:47Z",
  "published": "2026-08-05T20:43:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59732"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rclone/rclone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.74.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rclone archive extract allows S3 destination prefix escape via crafted archive paths"
}