Nick Craig-Wood 015fd0eba1 serve restic: fix --private-repos isolation bypass CVE-2026-59733 ...

A user could reach another user's private repository by sending a path
such as /<me>/../<victim>/config. The authorization check compares the
first path segment against the authenticated user, while the backend
object key was built from the raw, un-cleaned URL path.

Reject any non-canonical request path so the authorization segment and
the backend object key can no longer disagree.

Fixes GHSA-fqj9-69pf-6pjg

(cherry picked from commit dade21c161)

2026-07-08 16:51:49 +01:00

..

about

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

all

gui: new command to launch the https://github.com/rclone/rclone-web/ GUI

2026-04-10 11:39:50 +01:00

archive

archive extract: fix path traversal letting archives escape the destination CVE-2026-59732

2026-07-08 16:51:49 +01:00

authorize

docs: add link from authorize command docs to remote setup docs

2025-10-02 18:46:16 +02:00

backend

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

bisync

bisync: fix --conflict-loser pathname with --conflict-resolve newer

2026-05-22 12:48:37 +01:00

cachestats

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cat

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

check

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

checksum

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cleanup

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

cmount

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

config

rclone config string: reduce quoting with Human rendering for strings #8859

2025-10-03 15:54:15 +01:00

convmv

build: use "for i := range n", added in go1.22

2025-09-15 12:45:57 +01:00

copy

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

copyto

docs: clarify copyto command description - Fixes #9527

2026-07-08 16:40:00 +01:00

copyurl

copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.

2026-02-17 11:46:37 +00:00

cryptcheck

fix: comment typos

2025-11-13 13:47:40 +00:00

cryptdecode

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

dedupe

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

delete

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

deletefile

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

genautocomplete

completion: fix powershell completion corrupting non-ASCII names - fixes #9412

2026-07-08 16:39:04 +01:00

gendocs

gendocs: refactor and add logging of skipped command docs

2025-09-02 14:06:31 +02:00

gitannex

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

gui

gui: update embedded release to 1.1.8

2026-05-22 16:30:02 +01:00

hashsum

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

link

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

listremotes

listremotes: add --exact flag for filtering - fixes #9076

2026-04-24 16:23:12 +01:00

ls

docs: mention use of ListR feature in ls docs

2025-12-15 09:11:00 +01:00

lsd

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsf

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsjson

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

lsl

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

md5sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

mkdir

docs: group the global flags and make them appear on command and flags pages

2023-08-02 12:53:09 +01:00

mount

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

mount2

cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets

2026-07-08 16:40:00 +01:00

mountlib

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

move

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

moveto

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

ncdu

build: enable support for aix/ppc64

2025-10-27 13:34:58 +00:00

nfsmount

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

obscure

docs: fix echo command syntax for password input

2026-01-18 20:56:26 +01:00

purge

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rc

rc: flip auth default so all endpoints require auth unless opted out

2026-04-19 13:31:27 +01:00

rcat

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

rcd

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

reveal

docs: add minimum versions to the command pages

2022-12-03 18:58:55 +01:00

rmdir

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rmdirs

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

selfupdate

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

serve

serve restic: fix --private-repos isolation bypass CVE-2026-59733

2026-07-08 16:51:49 +01:00

settier

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

sha1sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

size

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

sync

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

test

test speed: fix formatting of help

2025-11-21 17:02:45 +00:00

touch

touch: add metadata when using --metadata-set

2026-02-26 16:20:24 +00:00

tree

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

version

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

cmd.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

completion.go

cmd: make auto completion work for all shells and reduce the size

2024-02-29 14:46:50 +00:00

help.go

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

progress.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

selfupdate_disabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

selfupdate_enabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

siginfo_bsd.go

build: update logging statements to make json log work - fixes #6038

2024-09-06 17:04:18 +01:00

siginfo_others.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00