Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as Zip Slip (CWE-22), stems from improper handling of untrusted zip entry names within the rclone archive backend. Specifically, the (*Fs).readZip function in backend/archive/zip/zip.go was the central point where these malicious paths were processed. The original implementation used path.Clean but failed to fully neutralize path traversal sequences (e.g., ../../) that could escape the archive's intended namespace. This meant that a crafted zip file could contain entries whose Remote() path would point outside the expected directory. When rclone copy or rclone sync operations were performed on such a zip, the unsanitized paths would be used as destination paths, leading to arbitrary file writes. The patches introduce sanitize.Path to rigorously validate and reject such malicious paths, and also tighten an existing root boundary check, confirming (*Fs).readZip as the vulnerable function.
(*Fs).readZipbackend/archive/zip/zip.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rclone/rclone | go | >= 1.72.0, < 1.75.1 | 1.75.1 |