medium

CVE-2026-59732

Go · github.com/rclone/rclone

Summary

rclone archive extract allows S3 destination prefix escape via crafted archive paths

Severity
medium
CVSS
5
EPSS
0.3% (p18)
CWE
CWE-22
Also known as
GHSA-4vr5-p2gc-h23p
Published
2026-08-05
Updated
2026-08-05

Advisory details

Summary

rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive. A malicious archive entry containing parent path components such as ../ can escape the requested extraction prefix and create or overwrite sibling objects in the same bucket/path scope.

Details

The affected code path is in cmd/archive/extract/extract.go.

In ArchiveExtract(), the archive entry path is taken from f.NameInArchive. The code strips only a leading ./ prefix and then joins the archive entry path with the destination directory:

remote := f.NameInArchive
remote = strings.TrimPrefix(remote, "./")
if dstDir != "" {
    remote = path.Join(dstDir, remote)
}
_, err = operations.Rcat(ctx, dst, remote, fin, f.ModTime(), nil)

Parent path components such as ../ are not rejected before path.Join() is used.

When the destination is an S3-style remote such as:

:s3:bucket/safe/prefix

rclone creates the destination filesystem rooted at bucket/safe and treats prefix as the destination directory. If the archive contains an entry named:

../escaped-from-prefix.txt

then path.Join("prefix", "../escaped-from-prefix.txt") resolves to:

escaped-from-prefix.txt

As a result, the S3 backend uploads the object to:

bucket/safe/escaped-from-prefix.txt

instead of the expected destination:

bucket/safe/prefix/escaped-from-prefix.txt

This allows an attacker-controlled archive to escape the selected extraction prefix on object-storage remotes.

PoC

Test environment:

Steps to reproduce:https://drive.google.com/file/d/1P_cLKFgiWSVSATB8500yP28jdzwt9FAt/view?usp=sharing

  1. Extract the attached PoC ZIP.

  2. Run the PoC script:

powershell -ExecutionPolicy Bypass -File .\run-poc.ps1 -RcloneExe "C:\path\to\rclone.exe"
  1. The PoC creates a ZIP archive containing this entry:
../escaped-from-prefix.txt
  1. The PoC starts a local fake S3 endpoint and runs rclone with an S3-style destination prefix:
rclone archive extract malicious.zip :s3:bucket/safe/prefix
  1. Observe the fake S3 request log.

Expected safe behavior:

PUT /bucket/safe/prefix/escaped-from-prefix.txt

Observed behavior:

PUT /bucket/safe/escaped-from-prefix.txt?x-id=PutObject

This shows that the archive entry escaped the requested safe/prefix destination and was written under safe/ instead.

The PoC package includes:

Impact

An attacker who supplies an archive that a victim extracts with rclone archive extract can cause extracted files to be written outside the destination prefix selected by the victim when the destination is an S3-style object storage remote.

Depending on the victim's configured remote credentials and bucket permissions, this may allow creation or overwrite of sibling objects outside the intended extraction directory/prefix.

This does not require compromising the S3 service itself. The attack relies on the victim extracting an attacker-controlled archive with rclone into an object-storage prefix.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.