CVE-2026-88014
- Source
- https://cve.org/CVERecord?id=CVE-2026-88014
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-88014.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-88014
- Aliases
- Downstream
DEBIAN (1)
openSUSE (1)
UBUNTU (1)
- Related
- Published
- 2026-09-10T15:48:32Z
- Modified
- 2026-10-22T10:30:55Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N CVSS Calculator
- Summary
- rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
- Details
-
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-22" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88014.json" }- References
-
- https://github.com/rclone/rclone/releases/tag/v1.75.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88014.json
- https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q
- https://nvd.nist.gov/vuln/detail/CVE-2026-88014
- https://github.com/rclone/rclone/commit/5dae3adbf571a6cd9ba501eb47397a7e871e1ae0
- https://github.com/rclone/rclone/commit/6507e13d5a83789f500af96d7188c302c9d74d98
Affected packages
Git / github.com/rclone/rclone
Affected ranges
- Type
- GIT
- Repo
- https://github.com/rclone/rclone
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.72.0" }, { "fixed": "1.75.1" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "5dae3adbf571a6cd9ba501eb47397a7e871e1ae0" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "6507e13d5a83789f500af96d7188c302c9d74d98" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.75.1", "range": [ { "fixed": "687d264b689b8c49a67e2e52a8a5e0caa01c04ce" } ], "source": "REFERENCES_TAG" } ] }