Vulnerability record · CVE-2026-59732 · published 14 July 2026

CVE-2026-59732: Rclone path traversal vulnerability

Rclone · Rclone

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.

5.0 CVSS 3.1 Medium EPSS 0.26% · top 83.9% CWE-22 · Path traversal

5.0CVSS 3.1 base score

0.26%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

5References, 2 tagged exploit

21 Jul 2026Last modified by NVD

Description

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Rclone Rclone

References

Link	Tags
https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c	Patch
https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d	Patch
https://github.com/rclone/rclone/releases/tag/v1.74.4	Release Notes
https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p	ExploitVendor Advisory
https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p	ExploitVendor Advisory

Track CVE-2026-59732 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-88018Rclone improper authentication vulnerabilityrclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 config…EPSS 0.51%10 Sep 2026 9.8CVE-2026-49980Rclone missing authentication for critical function vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --…EPSS 0.78%24 Jun 2026 9.2CVE-2026-41176Rclone missing authentication for critical function vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is expose…EPSS 3.2%23 Apr 2026 9.2CVE-2026-41179Rclone os command injection vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to…EPSS 5.3%23 Apr 2026 8.8CVE-2026-59733Rclone path traversal vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --…EPSS 0.55%14 Jul 2026 8.8CVE-2026-54572Rclone link following vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclon…EPSS 0.40%14 Jul 2026 7.5CVE-2020-28924Rclone vulnerabilityAn issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak pas…EPSS 1.4%19 Nov 2020 7.5CVE-2018-12907Rclone information exposure vulnerabilityIn Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of an…EPSS 1.3%27 Jun 2018

Source: NIST National Vulnerability Database (record CVE-2026-59732), CISA KEV, FIRST EPSS (scores of 2026-10-03). This page is refreshed as NVD updates the record.