Every CVE Search/ Get API key

CVE-2026-88014

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

6.3 MediumFix available

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.15%Unchanged since Sep 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
CVE-2026-88014
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-75574 6.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
EUVD-2026-75574
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-66hp-wgxq-6f5q 6.3

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary

backend/archive mounts a zip file as a browsable, syncable rclone Fs (e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:). Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip() in backend/archive/zip/zip.go applies path.Clean to the entry name, but this alone cannot fully neutralize a name with more .. components than real segments preceding them (e.g. "../../etc/cron.d/evil" stays exactly as-is after cleaning). When the archive is mounted with an empty root (the common case), there was no check at all that the resulting name stayed inside the archive's own namespace, so it was stored verbatim and returned unchanged by Object.Remote().

fs/sync/fs/operations use srcObj.Remote() directly as the destination-relative path when copying between filesystems, so a maliciously crafted zip file can cause rclone copy/sync to attempt writes outside the intended destination directory on whatever backend it targets - this is the well-known "Zip Slip" vulnerability class (https://security.snyk.io/research/zip-slip-vulnerability) applied to rclone's own zip-mounting backend. It is distinct from cmd/archive/extract, which already validates via its own destPath() choke point and is not affected.

Details

Vulnerable code (before fix), backend/archive/zip/zip.go, (*Fs).readZip:

for _, file := range zr.File {
	remote := strings.Trim(path.Clean(file.Name), "/")
	if remote == "." { remote = "" }
	remote = path.Join(f.prefix, remote)
	if f.root != "" {
		// Ignore all files outside the root
		if !strings.HasPrefix(remote, f.root) { continue }
		...
	}
	...
	o := &Object{f: f, remote: remote, ...}
	dt.Add(o)
}

The escape check only ran when f.root != "", and even then used a bare strings.HasPrefix with no boundary check (so f.root="foo" incorrectly also matched a sibling entry "foobar").

PoC

Built a zip in memory with Go's real archive/zip writer (entry name "../../etc/cron.d/evil", not sanitized by the writer either), wrote it to disk, and mounted it via the actual production constructor zip.New(ctx, localFs, "evil.zip", "", ""):

zip entry Name="../../etc/cron.d/evil" -> Object.Remote()="../../etc/cron.d/evil"

Fully outside the archive's own namespace - confirmed via a regression test that mounts the malicious zip through the real local backend and inspects the resulting Fs's internal dirtree and every Object's Remote().

Impact

A user who runs rclone copy/sync/mount against an untrusted zip file (downloaded, e-mailed, etc.) can have files written outside the intended destination directory on the destination backend, depending on that backend's own confinement. No server compromise or custom remote configuration is required from the attacker - only a crafted zip file and a normal rclone copy/sync invocation by the victim.

Fix

Skip any zip entry whose cleaned+prefixed name still escapes the archive's own namespace, rather than exposing it. Also tightened the pre-existing root filter's weak prefix check.

Record
GHSA-66hp-wgxq-6f5q
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 6.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
CVE-2026-88014
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 6.3

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
CVE-2026-88014
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88014 6.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
DEBIAN-CVE-2026-88014
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-66hp-wgxq-6f5q 6.3

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary

backend/archive mounts a zip file as a browsable, syncable rclone Fs (e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:). Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip() in backend/archive/zip/zip.go applies path.Clean to the entry name, but this alone cannot fully neutralize a name with more .. components than real segments preceding them (e.g. "../../etc/cron.d/evil" stays exactly as-is after cleaning). When the archive is mounted with an empty root (the common case), there was no check at all that the resulting name stayed inside the archive's own namespace, so it was stored verbatim and returned unchanged by Object.Remote().

fs/sync/fs/operations use srcObj.Remote() directly as the destination-relative path when copying between filesystems, so a maliciously crafted zip file can cause rclone copy/sync to attempt writes outside the intended destination directory on whatever backend it targets - this is the well-known "Zip Slip" vulnerability class (https://security.snyk.io/research/zip-slip-vulnerability) applied to rclone's own zip-mounting backend. It is distinct from cmd/archive/extract, which already validates via its own destPath() choke point and is not affected.

Details

Vulnerable code (before fix), backend/archive/zip/zip.go, (*Fs).readZip:

for _, file := range zr.File {
	remote := strings.Trim(path.Clean(file.Name), "/")
	if remote == "." { remote = "" }
	remote = path.Join(f.prefix, remote)
	if f.root != "" {
		// Ignore all files outside the root
		if !strings.HasPrefix(remote, f.root) { continue }
		...
	}
	...
	o := &Object{f: f, remote: remote, ...}
	dt.Add(o)
}

The escape check only ran when f.root != "", and even then used a bare strings.HasPrefix with no boundary check (so f.root="foo" incorrectly also matched a sibling entry "foobar").

PoC

Built a zip in memory with Go's real archive/zip writer (entry name "../../etc/cron.d/evil", not sanitized by the writer either), wrote it to disk, and mounted it via the actual production constructor zip.New(ctx, localFs, "evil.zip", "", ""):

zip entry Name="../../etc/cron.d/evil" -> Object.Remote()="../../etc/cron.d/evil"

Fully outside the archive's own namespace - confirmed via a regression test that mounts the malicious zip through the real local backend and inspects the resulting Fs's internal dirtree and every Object's Remote().

Impact

A user who runs rclone copy/sync/mount against an untrusted zip file (downloaded, e-mailed, etc.) can have files written outside the intended destination directory on the destination backend, depending on that backend's own confinement. No server compromise or custom remote configuration is required from the attacker - only a crafted zip file and a normal rclone copy/sync invocation by the victim.

Fix

Skip any zip entry whose cleaned+prefixed name still escapes the archive's own namespace, rather than exposing it. Also tightened the pre-existing root filter's weak prefix check.

Record
GHSA-66hp-wgxq-6f5q
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88014 6.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
UBUNTU-CVE-2026-88014
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVBIT-rclone-2026-88014 No score

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the selected destination on backends that do not independently confine the path. The non-empty root check also used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar entries. This issue is fixed in version 1.75.1.

Record
BIT-rclone-2026-88014
Updated
2026-11-02
OSVGO-2026-6464 No score

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Record
GO-2026-6464
Updated
2026-11-02
OSVopenSUSE-SU-2026:21897-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
openSUSE-SU-2026:21897-1
Updated
2026-11-02
OSVSUSE-SU-2026:23855-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23855-1
Updated
2026-11-02
OSVSUSE-SU-2026:23863-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/rclone/rclone
Go
 1.72.0 up to 1.75.1
1.75.1
rclone
Bitnami
 1.72.0 up to 1.75.1
1.75.1
rclone
Debian:12
 All versions, plus listed versions
1.60.1+dfsg-21.60.1+dfsg-31.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
rclone
Debian:13
 All versions, plus listed versions
1.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
rclone
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.36-31.36-3ubuntu0.11.36-3ubuntu0.2
 None known
rclone
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.47.0+ex1-61.47.0+ex1-71.49.5-21.49.5-31.50.2-21.50.2-2ubuntu0.11.50.2-2ubuntu0.21.50.2-2ubuntu0.2+esm1
 None known
rclone
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.53.3-11.53.3-21.53.3-41.53.3-4ubuntu11.53.3-4ubuntu1.22.04.1
Show 7 moreShow less
1.53.3-4ubuntu1.22.04.21.53.3-4ubuntu1.22.04.31.53.3-4ubuntu1.22.04.3+esm11.53.3-4ubuntu1.22.04.41.53.3-4ubuntu1.22.04.4+esm11.53.3-4ubuntu1.22.04.51.53.3-4ubuntu1.22.04.5+esm1
 None known
rclone
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.60.1+dfsg-2build11.60.1+dfsg-31.60.1+dfsg-3ubuntu0.24.04.11.60.1+dfsg-3ubuntu0.24.04.21.60.1+dfsg-3ubuntu0.24.04.3
Show 6 moreShow less
1.60.1+dfsg-3ubuntu0.24.04.41.60.1+dfsg-3ubuntu0.24.04.4+esm11.60.1+dfsg-3ubuntu0.24.04.51.60.1+dfsg-3ubuntu0.24.04.5+esm11.60.1+dfsg-3ubuntu0.24.04.61.60.1+dfsg-3ubuntu0.24.04.6+esm1
 None known
rclone
Ubuntu:26.10
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu31.69.3+dfsg-31.69.3+dfsg-3ubuntu1
 None known
rclone
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu21.60.1+dfsg-4ubuntu31.60.1+dfsg-4ubuntu3.11.60.1+dfsg-4ubuntu3.1+esm11.60.1+dfsg-4ubuntu3.21.60.1+dfsg-4ubuntu3.2+esm1
 None known
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88014 is a medium vulnerability (CVSS 6.3) in Rclone, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in github.com/rclone/rclone 1.75.1.

References

Show 98 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open