THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-66hp-wgxq-6f5q (medium) — rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

[GHSA] GHSA-66hp-wgxq-6f5q (medium) — rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

highgithub_advisoriesPublished 2026-09-10

GHSA-66hp-wgxq-6f5q Severity: medium CVE: CVE-2026-88014

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

### Summary `backend/archive` mounts a zip file as a browsable, syncable rclone `Fs` (e.g. `rclone lsf :zip:downloaded.zip` or `rclone copy :zip:downloaded.zip dest:`). Go's `archive/zip` package does not sanitize `file.Name` - it

Indicators of compromise

CVE-2026-88014cve
https://security.snyk.io/research/zip-slip-vulnerabilityurl

Original source: https://github.com/advisories/GHSA-66hp-wgxq-6f5q