rclone Archive/Zip Vulnerability: Zip Slip Attack Risk
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- >= 1.72.0, < 1.75.1
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the rclone archive/zip package that could allow a Zip Slip attack due to unsanitized zip entry names.
What happened
An early warning has been issued regarding a vulnerability in the rclone archive/zip package. The vulnerability, tracked as GHSA-66HP-WGXQ-6F5Q, involves unsanitized zip entry names that could allow a malicious archive to escape its own namespace. This is known as a Zip Slip attack. The affected versions of rclone are those greater than or equal to 1.72.0 and less than 1.75.1. The vulnerability has not been exploited in the wild as of the latest information.
The issue was first flagged on 2026-09-10T23:03:16+00:00. The rclone team has recommended upgrading to the latest version of rclone that includes the fix for this vulnerability. Users of the affected versions should take immediate action to assess their exposure and apply the necessary updates.
What to do about it
- Check your rclone version to determine if it falls within the affected range (greater than or equal to 1.72.0 and less than 1.75.1).
- If your version is affected, upgrade to the latest version of rclone that includes the fix for this vulnerability.
- Review your system for any signs of unauthorized access or unusual activity that may indicate an attempted exploit.
- Monitor the primary sources for updates on the vulnerability and any additional recommendations from the rclone team.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rclone version 1.72.0 or later but before 1.75.1.
What should I do right now?
Check your rclone version and upgrade to the latest version if you are using an affected version.
Has this vulnerability been exploited in the wild?
No, the vulnerability has not been exploited in the wild according to the latest information.