{"vulnerability": "cve-2026-5973", "sightings": [{"uuid": "c1736094-1fb4-474c-89b7-bd485ff32fa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5973", "type": "seen", "source": "Telegram/B-z3crZ1dI3tmPIxruR2FuLMmThruFg0zQ194epA7uIe11s", "content": "", "creation_timestamp": "2026-04-09T21:23:00.000000Z"}, {"uuid": "81ea7086-a9ca-4da0-a0c2-bf2ff78f614e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59732", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p", "content": "", "creation_timestamp": "2026-08-05T22:35:16.418004Z"}, {"uuid": "b6456d56-80e2-43b9-92b1-7b6ccdeba00a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59733", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg", "content": "", "creation_timestamp": "2026-08-05T22:35:18.603178Z"}, {"uuid": "1712105b-9861-4c55-9fa8-eeb5d4c945da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59732", "type": "seen", "source": "https://gist.github.com/alon710/7cd2b59244b6ec677e9295bd453cf08b", "content": "# CVE-2026-59732: CVE-2026-59732: Path Traversal (Zip Slip) Vulnerability in rclone archive extract\n\n> **CVSS Score:** 5.0\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59732\n\n## Summary\nA path traversal vulnerability (Zip Slip variant) exists in rclone's archive extract functionality before version 1.74.4. The command fails to sanitize relative directory components in archive headers, allowing files to be written outside the target directory or cloud prefix. This issue can result in arbitrary file writes or cloud object overwrites depending on the permissions of the credentials used. Nick Craig-Wood authored the patch on June 29, 2026, which was released in version 1.74.4 on July 14, 2026. This vulnerability is assigned CVE-2026-59732 and is cataloged as GHSA-4vr5-p2gc-h23p. This report provides a detailed root cause analysis, code-level diff, and remediation steps.\n\n## TL;DR\nUnsanitized path extraction in rclone allows directory traversal and arbitrary file overwrite.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Local (AV:L)\n- **CVSS Score**: 5.0 (Medium)\n- **EPSS Score**: 0.00213 (Percentile: 11.63%)\n- **Impact**: Integrity and Availability (Partial)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- rclone\n- **rclone**: < 1.74.4 (Fixed in: `1.74.4`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.74.4 or later\n- Enforce IAM least privilege on S3 buckets using prefix-based access controls\n- Isolate rclone execution in containerized environments with limited mounts\n\n**Remediation Steps:**\n1. Identify all deployed instances of rclone across automation pipelines, containers, and developer environments.\n2. Upgrade instances to version 1.74.4 or above.\n3. Verify the upgrade using the command 'rclone version'.\n4. Configure IAM policies to restrict cloud credentials to specific prefixes.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/rclone/rclone/security/advisories/GHSA-4vr5-p2gc-h23p)\n- [Core Fix Commit (Main)](https://github.com/rclone/rclone/commit/1a746732441e8158f32fab35924b23701e719a8c)\n- [Cherry-Picked Fix Commit (Stable)](https://github.com/rclone/rclone/commit/d11efe0d58fe6a2d6d90675bb9d8ee5840c51e1d)\n- [rclone v1.74.4 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n- [NVD CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-59732)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-59732)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59732) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T07:31:27.615327Z"}, {"uuid": "a0691132-d055-421e-acce-eed26bee84b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://gist.github.com/alon710/7ddcb99c6c6e60ab01c10a8cda75b225", "content": "# CVE-2026-59733: CVE-2026-59733: Path Traversal and Authorization Bypass in Rclone serve restic\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59733\n\n## Summary\nA critical path traversal and authorization bypass vulnerability exists in the rclone serve restic command when multi-user isolation is enabled using the --private-repos flag. Due to a middleware desynchronization flaw, authenticated users can access, modify, or delete backup repositories belonging to other tenants.\n\n## TL;DR\nA middleware path-desynchronization defect in rclone serve restic allows authenticated users to bypass repository isolation and access other tenants' backups using path traversal sequences.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-639\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1**: 8.8 (High)\n- **EPSS Score**: 0.00422\n- **Impact**: Complete compromise of repository confidentiality, integrity, and availability\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- Rclone (serve restic subcommand)\n- **rclone**: < 1.74.4 (Fixed in: `1.74.4`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.74.4 or higher\n- Run separate single-tenant daemons instead of using --private-repos flag\n- Deploy an upstream WAF or reverse proxy to block path traversal sequences\n\n**Remediation Steps:**\n1. Identify all active rclone instances executing 'serve restic' with the '--private-repos' argument\n2. Download the latest stable release (v1.74.4 or later) from official sources\n3. Replace the existing rclone binary with the updated version\n4. Restart the service and monitor access logs for HTTP 400 responses to verify block mechanisms\n\n## References\n\n- [GHSA-fqj9-69pf-6pjg: Path traversal and authorization bypass in rclone serve restic](https://github.com/rclone/rclone/security/advisories/GHSA-fqj9-69pf-6pjg)\n- [Rclone Fix Commit](https://github.com/rclone/rclone/commit/015fd0eba1cb138eef081517795fed47a2873f2d)\n- [Rclone v1.74.4 Release Notes](https://github.com/rclone/rclone/releases/tag/v1.74.4)\n- [NVD - CVE-2026-59733](https://nvd.nist.gov/vuln/detail/CVE-2026-59733)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59733) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T09:31:29.269193Z"}, {"uuid": "819cc0b9-df16-4386-b76b-4777988a960b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59731", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq62qs7m6k26", "content": "CVE-2026-59731 - Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch\nCVE ID : CVE-2026-59731\n \n Published : July 8, 2026, 5:17 p.m. | 3\u00a0hours, 57\u00a0minutes ago\n \n Description : Astro is a web framework for content-driven website...", "creation_timestamp": "2026-07-08T21:27:43.402363Z"}, {"uuid": "d314e509-03fd-4afd-bf29-93f69e302a93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqacbssmiz2z", "content": "CVE-2026-59734 - Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution\nCVE ID : CVE-2026-59734\n \n Published : July 9, 2026, 6:16 p.m. | 15\u00a0minutes ago\n \n Description : Coolify is an open-source and self-hostable tool for managing servers, app...", "creation_timestamp": "2026-07-09T18:47:50.459488Z"}, {"uuid": "e83fa935-80cb-4173-9002-169ef9983392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "seen", "source": "https://t.me/GithubRedTeam/92945", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-59734-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cybertechajju\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 08:29:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nOS Command Injection in Health Check \u2192 Remote Code Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:04.713615Z"}, {"uuid": "188a840e-f5ba-4351-8e0d-7ea0b9c7cfcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92945", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-59734-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cybertechajju\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 08:29:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nOS Command Injection in Health Check \u2192 Remote Code Execution\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:08.182836Z"}, {"uuid": "e92973a9-218e-44ad-9b0e-99f94566ce04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqncqefi572b", "content": "\ud83d\udfe0 CVE-2026-59733 - High (8.8)\n\nRclone is a command-line program to sync files and directories to and from different cloud storag...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-59733/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-14T23:00:35.453472Z"}, {"uuid": "685233d0-87a5-48b5-9fe6-8cf42a69e1b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqnhy5ivbc2q", "content": "CVE-2026-59733 - rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories\nCVE ID : CVE-2026-59733\n \n Published : July 14, 2026, 10:17 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Descri...", "creation_timestamp": "2026-07-15T00:34:24.873870Z"}, {"uuid": "7ebbf6e1-295c-458e-8f76-af545f5edddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59732", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqnghjm5lh2i", "content": "CVE-2026-59732 - rclone archive extract allows S3 destination prefix escape via crafted archive paths\nCVE ID : CVE-2026-59732\n \n Published : July 14, 2026, 10:17 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Description : Rclone is a command-line program to sync files and directories to an...", "creation_timestamp": "2026-07-15T00:07:13.374311Z"}, {"uuid": "68018325-2bee-49bc-8b85-292dab0a1039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "seen", "source": "Telegram/Rsr0Dif1o1fLqoV9ucTcV-Dk0Nx-O3i5Fvrar3xcx8-ClWk", "content": "", "creation_timestamp": "2026-07-16T19:00:11.914482Z"}, {"uuid": "9fac214d-7705-4b60-8af6-5a0337cb4587", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "seen", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "content": "", "creation_timestamp": "2026-07-16T19:00:11.994292Z"}, {"uuid": "479dc766-411b-4669-a25e-0923bd4b2558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "seen", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "content": "", "creation_timestamp": "2026-07-17T00:00:27.496914Z"}, {"uuid": "dc6b4bf8-558c-49c6-834e-3aedc2f44cbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "seen", "source": "Telegram/Rsr0Dif1o1fLqoV9ucTcV-Dk0Nx-O3i5Fvrar3xcx8-ClWk", "content": "", "creation_timestamp": "2026-07-17T00:00:27.408756Z"}, {"uuid": "8b944dc3-c55d-49e5-96cb-6853b65d22cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "published-proof-of-concept", "source": "Telegram/Rsr0Dif1o1fLqoV9ucTcV-Dk0Nx-O3i5Fvrar3xcx8-ClWk", "content": "", "creation_timestamp": "2026-07-18T00:00:44.665975Z"}, {"uuid": "7b40e166-a576-4688-93de-2d0c722825e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59734", "type": "published-proof-of-concept", "source": "Telegram/NYIVWEz-EsB8ef7TazBMjtaMuwPshfSztf-SWjeg1CPetB0", "content": "", "creation_timestamp": "2026-07-18T00:00:44.743697Z"}, {"uuid": "c1101b43-88dd-481b-ab9a-167da26399f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqvkc6bevg2y", "content": "\ud83d\udccc CVE-2026-59733 - Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --p... https://www.cyberhub.blog/cves/CVE-2026-59733", "creation_timestamp": "2026-07-18T05:37:06.976559Z"}, {"uuid": "bf2b8aa3-4010-4b1e-bd48-12aa475580fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59731", "type": "published-proof-of-concept", "source": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv", "content": "", "creation_timestamp": "2026-07-20T22:35:02.887609Z"}, {"uuid": "75986dfa-aa4e-43e6-a1cf-7e79a0ea4ff4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk2ozse62i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59733 \u0432 rclone: \u043e\u0431\u0445\u043e\u0434 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0443\u0442\u044c URL\n\n\n\nhttps://kripta.biz/posts/7981FCA8-AC9C-4451-B498-922037D87BC6", "creation_timestamp": "2026-07-27T09:04:09.647333Z"}, {"uuid": "b2d7627c-23e7-4888-bd54-2127239120ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59733", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmk2wojvo25", "content": "\u05e4\u05d2\u05d9\u05e2\u05d4 \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1\u05e8\u05e7\u05dc\u05d0\u05d5\u05df: CVE-2026-59733 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d2\u05d9\u05e9\u05d4 \u05dc\u05d0 \u05de\u05d5\u05e8\u05e9\u05ea \u05dc\u05de\u05d0\u05d2\u05e8\u05d9 \u05e4\u05e8\u05d8\u05d9\u05d9\u05dd\n\n\n\nhttps://khesef.xyz/posts/C242D62F-2C46-4575-BC3A-AC59F9C4897A", "creation_timestamp": "2026-07-27T09:04:17.847253Z"}, {"uuid": "1f3f7b4c-ca6b-4391-bfd1-5c44b74b4cb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59732", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmjiejzxj2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59732 \u0432 rclone: \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u0430\u0440\u0445\u0438\u0432\u044b\n\n\n\nhttps://kripta.biz/posts/AFC98875-E934-404C-B987-A8203F6A61F4", "creation_timestamp": "2026-07-27T08:53:54.935441Z"}, {"uuid": "d472c422-0b3f-4119-839a-f9a6a68114d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59732", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmjuiwi3p2m", "content": "\u05d7\u05e9\u05d9\u05e4\u05ea \u05e4\u05d2\u05d9\u05e2\u05d4 \u05e7\u05e9\u05d4 \u05d1\u05e8\u05e7\u05dc\u05d0\u05d5\u05df: CVE-2026-59732 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05d4\u05ea\u05d7\u05de\u05e7\u05d5\u05ea \u05de\u05de\u05e2\u05e8\u05db\u05ea \u05d4\u05e7\u05d1\u05e6\u05d9\u05dd \u05e9\u05dc S3\n\n\n\nhttps://khesef.xyz/posts/34853E87-FF44-4758-8EB1-19E4D6785438", "creation_timestamp": "2026-07-27T09:00:41.962049Z"}]}