CVE-2026-59732: Rclone Path Traversal Vulnerability

CVE-2026-59732 Overview

CVE-2026-59732 is a path traversal vulnerability [CWE-22] in Rclone, a command-line utility used to synchronize files across cloud storage providers. Versions prior to 1.74.4 fail to sanitize archive entries containing parent path components such as ../ during the rclone archive extract operation. A crafted archive can write files outside the user-selected destination prefix, enabling creation or overwrite of sibling objects within the same bucket or path scope. The issue is resolved in Rclone 1.74.4.

Critical Impact
An attacker who convinces a user to extract a malicious archive can overwrite files outside the intended destination, potentially tampering with data in cloud storage buckets.

Affected Products

Rclone versions prior to 1.74.4
All platforms supporting rclone archive extract
Cloud storage backends where extracted content is written

Discovery Timeline

2026-07-14 - CVE-2026-59732 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-59732

Vulnerability Analysis

The vulnerability resides in cmd/archive/extract/extract.go. When Rclone processes archive entries, it takes the NameInArchive field directly and joins it with the destination directory using path.Join. The prior implementation stripped only a leading ./ prefix and relied on that limited normalization to prevent traversal. It did not validate whether the resulting path escaped the destination prefix after resolving ../ components.

Because path.Join cleans but does not confine paths, entries such as ../evil.txt resolve to sibling locations relative to dstDir. On object storage backends, this permits an attacker-supplied archive to create or overwrite objects outside the intended prefix within the same bucket or path scope.

User interaction is required. A victim must invoke rclone archive extract against an attacker-controlled archive. The result is limited integrity and availability impact on data at the destination.

Root Cause

The root cause is missing containment validation on decompressed archive entry names before they are joined with the destination directory. The extraction callback trusted the archive-supplied path and only handled the ./ case, leaving ../ traversal viable.

Attack Vector

An attacker crafts an archive (for example, a tarball) containing entries whose names include ../ sequences. When a user extracts this archive with rclone archive extract into any destination, the traversal escapes the destination prefix and writes to sibling paths in the target backend.

// Patch: cmd/archive/extract/extract.go
// Before: direct use of f.NameInArchive with only "./" prefix stripping
// After: destPath() validates entries stay within dstDir
err = ex.Extract(ctx, in, func(ctx context.Context, f archives.FileInfo) error {
    remote, err := destPath(f.NameInArchive, dstDir)
    if err != nil {
        return err
    }
    // Skip the archive root entry ("./") which has no name of its own.
    if remote == "" {
        return nil
    }
    // check if file should be extracted
    if !fi.Include(remote, f.Size(), f.ModTime(), fs.Metadata{}) {
        // ...
    }
    // ...
})
// Source: https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c

Detection Methods for CVE-2026-59732

Indicators of Compromise

Files or objects appearing outside the intended destination prefix following an rclone archive extract invocation
Archive entries whose logical paths contain ../ sequences when inspected with tar -tvf or equivalent
Unexpected modification timestamps on sibling objects in the same bucket or directory scope as a recent extract target

Detection Strategies

Inspect archives prior to extraction using tar -tvf archive.tar.gz and reject entries containing .. path components
Audit process execution logs for rclone archive extract commands and correlate with subsequent writes outside the specified destination
Enable object storage access logging (for example, AWS CloudTrail S3 data events) to identify PutObject operations to unexpected keys

Monitoring Recommendations

Track Rclone binary versions across endpoints and flag hosts running versions earlier than 1.74.4
Alert on write operations to cloud storage prefixes that fall outside declared automation scopes
Monitor for unusual file overwrite patterns in shared buckets following bulk extract jobs

How to Mitigate CVE-2026-59732

Immediate Actions Required

Upgrade Rclone to version 1.74.4 or later on all systems that use rclone archive extract
Avoid extracting untrusted archives with vulnerable Rclone versions until patching is complete
Review recent extractions against untrusted archives and validate destination integrity

Patch Information

The fix is available in Rclone 1.74.4. The patch introduces a destPath() helper in cmd/archive/extract/extract.go that validates each archive entry resolves within dstDir before writing. See the GitHub Security Advisory GHSA-4vr5-p2gc-h23p, the GitHub Release v1.74.4, and the remediation commit.

Workarounds

Extract archives only from trusted sources whose contents have been verified
Pre-scan archives with tar -tvf (or equivalent) and reject any entry containing ../ or absolute paths
Restrict credentials used with rclone archive extract to the minimum object storage prefix required, limiting blast radius of traversal writes

bash

# Verify installed version and upgrade
rclone version

# Upgrade using rclone self-update (requires prior installation)
rclone selfupdate --version v1.74.4

# Pre-extraction safety check: list entries and reject traversal
tar -tvf suspicious.tar.gz | awk '{print $NF}' | grep -E '(^\.\./|/\.\./|^/)' \
  && echo "UNSAFE: archive contains traversal entries" \
  || echo "OK: no traversal detected"