CyberRota Analysis
AI-GeneratedRclone versions prior to 1.74.4 are vulnerable to a path traversal issue in the archive extraction feature, which can lead to the extraction of files outside the intended destination, potentially allowing unauthorized creation or overwriting of files within the same storage bucket. This vulnerability poses a risk to users who rely on Rclone for managing cloud storage, particularly those handling sensitive data. Users of affected versions should prioritize upgrading to version 1.74.4 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as ../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)