Most recent entries from all

BIT-rclone-2026-59732 — rclone archive extract allows S3 destination prefix escape via crafted archive paths

Affected: Bitnami: rclone

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

certfr-2026-avi-1125 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-1125

EUVD-2026-339155

fkie_cve-2026-59732

GHSA-4vr5-p2gc-h23p — rclone archive extract allows S3 destination prefix escape via crafted archive paths

Affected: Go: github.com/rclone/rclone

### Summary

`rclone archive extract` can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as `../` can escape the requested extraction prefix and create or overwrite sibling objects in the same bucket/path scope.

### Details

The affected code path is in `cmd/archive/extract/extract.go`.

In `ArchiveExtract()`, the archive entry path is taken from `f.NameInArchive`. The code strips only a leading `./` prefix and then joins the archive entry path with the destination directory:

```go remote := f.NameInArchive remote = strings.TrimPrefix(remote, "./") if dstDir != "" { remote = path.Join(dstDir, remote) } _, err = operations.Rcat(ctx, dst, remote, fin, f.ModTime(), nil) ```

Parent path components such as `../` are not rejected before `path.Join()` is used.

When the destination is an S3-style remote such as:

```text :s3:bucket/safe/prefix ```

rclone creates the destination filesystem rooted at `bucket/safe` and treats `prefix` as the destination directory. If the archive contains an entry named:

```text ../escaped-from-prefix.txt ```

then `path.Join("prefix", "../escaped-from-prefix.txt")` resolves to:

```text escaped-from-prefix.txt ```

As a result, the S3 backend uploads the object to:

```text bucket/safe/escaped-from-prefix.txt ```

instead of the expected destination:

```text bucket/safe/prefix/escaped-from-prefix.txt ```

This allows an att…

openSUSE-SU-2026:11241-1 — rclone-1.74.4-1.1 on GA media

rclone-1.74.4-1.1 on GA media

UBUNTU-CVE-2026-59732

Affected: Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone

WID-SEC-W-2026-2266 — rclone: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um beliebige Dateien zu lesen und zu schreiben, sowie Informationen offenzulegen und Sicherheitsmechanismen zu umgehen.