Technical impact
The vulnerability exists in the rclone archive extract feature, wherein a crafted ZIP archive containing parent path components can cause the tool to write extracted files outside the user‑selected destination prefix. By using components such as '../', an attacker can create or overwrite sibling objects in the same bucket or path scope, effectively gaining write access to unintended locations. This flaw maps to CWE-22: Path Traversal.
Affected Systems
Affected product is rclone version 1.74.3 and earlier. Users running rclone prior to 1.74.4 on any platform or operating system could be impacted, regardless of the operating system, as the issue resides in the core archive extraction logic.
Risk and Exploitability
The CVSS score of 5.0 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV. Attack requires the user to run rclone archive extract with a crafted archive; therefore the likely attack vector is local or involves social engineering to obtain the right environment, but could be leveraged remotely if an attacker can deliver the archive via a networked service that invokes rclone.
Github GHSA