CVE-2026-59732
🔶 mediumSummary
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.
CVSS Score
5.0
Medium
EPSS Score
-
Published Date
2026-07-14
First Seen: 2026-07-15
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 19.2% of all 335,187 vulnerabilities in our database.
#270,979
Below average severity
Severity Percentile
Last Modified
2026-07-14
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L
CWE IDs (Weakness Types)