CVE-2026-88014 rclone CVE debrief

Who should care

Defenders managing systems with rclone installed, especially those using affected versions (1.72.0 to 1.75.0), should assess exposure and prioritize verification and remediation. They should review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-88014 is a path traversal issue in rclone that allows writes outside the selected destination on certain backends. Defenders should prioritize verifying and upgrading to rclone version 1.75.1 or later, especially for systems using affected versions and exposed to untrusted archive ZIP files.

• Potential unauthorized writes outside intended destination directories
• Possible data integrity issues on affected backends
• Need for verification of rclone version and exposure to untrusted ZIP files
• Priority for upgrading to version 1.75.1 or later

Technical summary

The rclone command-line program has a path traversal vulnerability in its archive ZIP backend method. This issue allows an attacker to write outside the selected destination on certain backends by exploiting the way rclone handles archive/zip.File.Name values from untrusted central directories. Entries like ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values used as destination-relative paths, allowing rclone copy or sync to write outside the selected destination. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Defensive priority

Defenders should prioritize verifying and upgrading to rclone version 1.75.1 or later, especially for systems using affected versions (1.72.0 to 1.75.0) and exposed to untrusted archive ZIP files.

Recommended defensive actions

• Verify and upgrade to rclone version 1.75.1 or later
• Review and restrict untrusted archive ZIP files
• Monitor for suspicious rclone activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue arises from the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go, which accepts archive/zip.File.Name values from an untrusted central directory. Entries like ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values used as destination-relative paths, allowing rclone copy or sync to write outside the selected destination.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.