Nick Craig-Wood 48da1774f4 rc: fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 ...

The --rc-serve GET/HEAD file serving path accepted bracketed inline
remotes from the URL and instantiated them, so a single
unauthenticated request could run a command as the rclone user via
backend options such as webdav bearer_token_command or sftp ssh, read
arbitrary local files, or change process-wide config via global.*
options.

This was the GET/HEAD equivalent of the POST hole fixed for
CVE-2026-41179, which only guarded the rc call dispatch path.

Now, unless the rc server has authentication configured or
--rc-no-auth is set, the serve path only allows remotes already
present in the config file: inline remotes, connection string
parameters and bare local paths are rejected. Connection string
global.* options are never honoured on the serve path, even when
authenticated.

See: GHSA-qw24-gh76-8rvv
(cherry picked from commit 2326ea79f7)

2026-06-05 15:22:03 +01:00

..

commands

Version v1.74.2

2026-05-22 17:11:48 +01:00

oracleobjectstorage

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

_index.md

docs: add missing Huawei Drive docs

2026-05-01 14:06:11 +01:00

alias.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

amazonclouddrive.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

archive.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

authors.md

Add John Volk to contributors

2026-05-01 12:46:46 +01:00

azureblob.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

azurefiles.md

azureblob,azurefile: fix documentation about federated identity

2026-04-24 18:21:22 +01:00

b2.md

docs: fix heading levels so sections appear in the table of contents

2026-05-22 12:48:37 +01:00

backends.md

docs: serve backend metadata as JSON on the website

2026-04-13 16:45:00 +01:00

bisync.md

Version v1.74.2

2026-05-22 17:11:48 +01:00

box.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

bugs.md

docs: fix markdownlint issues md007/ul-indent md004/ul-style

2025-07-21 20:23:16 +02:00

cache.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

changelog.md

Version v1.74.2

2026-05-22 17:11:48 +01:00

chunker.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

cloudinary.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

combine.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

compress.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

contact.md

docs: fix markdown lint issues in backend docs

2025-08-26 12:04:00 +02:00

crypt.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

docker.md

build: restrict the markdown languages to use for code blocks

2025-11-01 15:52:41 +01:00

docs.md

docs: fix misspellings

2026-05-22 12:48:37 +01:00

doi.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

downloads.md

docs: note macOS 10.15 (Catalina) support with version v1.70.3

2026-03-28 12:29:53 +00:00

drime.md

Version v1.74.1

2026-05-08 15:15:36 +01:00

drive.md

docs: fix heading levels so sections appear in the table of contents

2026-05-22 12:48:37 +01:00

dropbox.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

faq.md

docs: fix formatting

2026-01-23 16:55:52 +00:00

fichier.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

filefabric.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

filelu.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

filen.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

filescom.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

filtering.md

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

flags.md

Version v1.74.2

2026-05-22 17:11:48 +01:00

ftp.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

gofile.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

googlecloudstorage.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

googlephotos.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

gui.md

gui: embed compressed dist.zip in the binary for smaller, reproducible builds

2026-05-01 12:46:46 +01:00

hasher.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

hdfs.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

hidrive.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

http.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

huaweidrive.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

iclouddrive.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

imagekit.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

install.md

build: update to go1.26 and make go1.25 the minimum required version

2026-02-18 11:33:48 +00:00

install.sh

install.sh: fix harmless error message on install

2023-11-28 19:10:04 +00:00

internetarchive.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

internxt.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

jottacloud.md

jottacloud: support whitelabel service Phonero Sky

2026-05-22 12:48:37 +01:00

KEYS

docs: document release signing and verification

2023-09-11 12:28:23 +01:00

koofr.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

licence.md

docs: fix markdownlint issue md040/fenced-code-language

2025-07-21 20:23:16 +02:00

linkbox.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

local.md

fix(docs): Fix link to not be language specific

2026-04-02 17:57:02 +01:00

mailru.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

mega.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

memory.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

netstorage.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

onedrive.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

opendrive.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

overview.md

docs: fix typo

2026-04-21 21:06:49 +02:00

pcloud.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

pikpak.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

pixeldrain.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

premiumizeme.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

privacy.md

docs: update privacy policy with a section on user data

2025-10-14 16:24:07 +01:00

protondrive.md

Version v1.74.0

2026-05-01 15:56:56 +01:00

putio.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

qingstor.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

quatrix.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

rc.md

rc: fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980

2026-06-05 15:22:03 +01:00

release_signing.md

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

remote_setup.md

docs: fix various markdownlint issues

2025-11-01 18:54:19 +01:00

s3.md

Version v1.74.2

2026-05-22 17:11:48 +01:00

seafile.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

sftp.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

shade.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

sharefile.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

sia.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

smb.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

sponsor.md

docs: sponsor updates

2026-05-08 15:07:27 +01:00

storj.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

sugarsync.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

swift.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

tiers.md

docs: add tiering to the documentation - fixes #8873

2026-01-30 17:08:44 +00:00

ulozto.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

union.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

webdav.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

yandex.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00

zoho.md

docs: modernize rclone.org site design

2026-04-02 16:32:54 +01:00