CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-88014

A flaw was found in rclone. This vulnerability, known as Zip Slip, allows a remote attacker to write arbitrary files outside of the intended destination when processing a specially crafted ZIP archive. By manipulating archive entry names, an attacker can bypass path sanitization, leading to...

PT-2026-90513

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

Linux Distros Unpatched Vulnerability : CVE-2026-88014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend...

The vulnerability in the built-in ZIP-plugin of the runtime/autoload/zip.vim text editor in Vim allows a hacker to execute arbitrary commands.

The vulnerability in the built-in ZIP-plugin of the Vim text editor’s runtime/autoload/zip.vim module is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

GHSA-66HP-WGXQ-6F5Q rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

DEBIAN-CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

EUVD-2026-75574

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014

rclone versions 1.72.0 through 1.75.1 are affected by a Zip Slip vulnerability in the archive ZIP backend ((*Fs).readZip in backend/archive/zip/zip.go). The method accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without verifying they remai...

CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

PT-2026-89475

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

CVE-2026-78361: Missing Authorization

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...