A Zip Slip vulnerability exists in rclone’s archive/zip backend method, allowing an attacker to supply file names such as ../../etc/passwd that, after path cleaning, resolve outside the intended extraction directory. This flaw can enable overwriting of arbitrary files on the destination filesystem, potentially compromising confidentiality and integrity. The weakness is a classic path traversal flaw (CWE-22).

The vulnerability affects rclone version 1.72.0 through 1.75.1, a command‑line tool used for syncing files to and from cloud storage. It was fixed in rclone 1.75.1. Users running any affected release should be aware that the risk is confined to environments where rclone is executing sync or copy operations with write access to the destination.

With a CVSS score of 6.3 the severity is moderate. No EPSS data is available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is local or institutional usage of rclone where an attacker can supply a malicious archive during a sync or copy operation, and the target machine or backend does not enforce additional path confinement. Successful writing of files outside the designated destination, potentially damaging system files or sensitive data. The prerequisite for exploitation is that rclone runs with write permissions to the destination directory and that the backend does not independently enforce path restrictions.