Homepage

Directory Traversal Affecting rclone-compat package, versions <1.75.1-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.14% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-RCLONECOMPAT-19957905
  • published20 Sept 2026
  • disclosed10 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 10 Sep 2026

NewCVE-2026-88014  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Minimos:latest rclone-compat to version 1.75.1-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rclone-compat package and not the rclone-compat package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.