CVE-2026-88014: 
Rclone Analyse et atténuation des vulnérabilités

CVE-2026-88014 is a Zip Slip path traversal vulnerability in rclone's archive/zip backend that allows a maliciously crafted ZIP file to cause rclone to write files outside the intended destination directory. It affects rclone versions 1.72.0 through 1.75.0 (i.e., >= 1.72.0, < 1.75.1) and was disclosed on September 4, 2026, with a fix released in version 1.75.1. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in the (*Fs).readZip method within backend/archive/zip/zip.go. Go's archive/zip package does not sanitize file.Name values from a ZIP's central directory; rclone applied path.Clean to entry names but did not verify that the cleaned result remained within the archive's namespace — entries like ../../etc/cron.d/evil survive path.Clean unchanged and are stored verbatim as Object.Remote() values. Additionally, the non-empty root filter used strings.HasPrefix without a path boundary, so a root of foo would incorrectly match sibling entries named foobar. When fs/sync or fs/operations use srcObj.Remote() as a destination-relative path, a crafted ZIP can direct writes to arbitrary locations on the destination backend (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker-controlled ZIP file to cause rclone copy or sync operations to write arbitrary files outside the intended destination directory on the target backend, depending on that backend's own path confinement. This could enable overwriting sensitive system files (e.g., cron jobs, configuration files, or scripts), potentially leading to privilege escalation or persistent code execution on the destination system. Confidentiality and availability are not directly impacted; the primary risk is high integrity impact with a changed scope affecting resources beyond the archive's own namespace (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction — a victim must run rclone copy, sync, or mount against an attacker-supplied ZIP file — but requires no special privileges or server access from the attacker, only delivery of a crafted archive (GitHub Advisory, Feedly).

1. Craft a malicious ZIP archive: Using Go's archive/zip writer or any ZIP tool, create a ZIP file containing at least one entry with a path-traversal name such as ../../etc/cron.d/evil or ../escape.txt. These names are not sanitized by the ZIP writer and will survive path.Clean in vulnerable rclone versions.
2. Deliver the archive to the victim: Distribute the crafted ZIP via email, file sharing, download link, or any other channel to a user who operates rclone against untrusted archives.
3. Trigger rclone processing: The victim runs a command such as rclone copy :zip:downloaded.zip dest: or rclone sync :zip:malicious.zip /local/dest, causing rclone to mount the ZIP as a browsable Fs and enumerate its entries via readZip().
4. Path traversal occurs: The vulnerable readZip() method stores the unsanitized entry name (e.g., ../../etc/cron.d/evil) verbatim as Object.Remote(). When fs/sync or fs/operations copies the object, it uses this value as a destination-relative path, writing the file outside the intended destination directory.
5. Achieve arbitrary file write: Depending on the destination backend and permissions, the attacker's file is written to the traversed path (e.g., /etc/cron.d/evil), potentially enabling persistent code execution or privilege escalation (GitHub Advisory, Fix Commit).

• Logs: rclone log output containing Skipped N zip entries which escape the archive (present only in patched v1.75.1; absence of this message on older versions does not indicate safety). On vulnerable versions, no warning is emitted for traversal entries.
• File System: Unexpected files appearing outside the intended rclone destination directory, particularly in sensitive locations such as /etc/cron.d/, /etc/cron.hourly/, home directories, or application configuration paths; file timestamps correlating with rclone copy/sync execution times.
• Process: rclone process invocations referencing ZIP files from untrusted or external sources (e.g., downloaded archives), especially combined with write-capable destination backends.
• Network: Outbound connections from the destination host to unexpected addresses shortly after rclone operations, which may indicate execution of a dropped payload (GitHub Advisory).

Upgrade rclone to version 1.75.1 or later, which fixes the vulnerability by replacing the path.Clean-only sanitization with sanitize.Path (the same check used by rclone archive extract) that skips any entry containing .. path components, and tightens the root filter to require a path boundary (rclone v1.75.1 Release, Fix Commit). As a workaround for users unable to upgrade immediately, avoid running rclone copy, sync, or mount against ZIP files from untrusted sources. Note that cmd/archive/extract is not affected, as it already validates paths via its own destPath() choke point (GitHub Advisory).