BIT-rclone-2026-59732

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-59732.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-rclone-2026-59732
Aliases
Published
2026-07-19T23:51:45.627Z
Modified
2026-07-20T08:41:25.963158015Z
Summary
rclone archive extract allows S3 destination prefix escape via crafted archive paths
Details

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / rclone

Package

Name
rclone
Purl
pkg:bitnami/rclone

Severity

  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.74.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-59732.json"