Nick Craig-Wood dade21c161 serve restic: fix --private-repos isolation bypass CVE-2026-59733 ...

A user could reach another user's private repository by sending a path
such as /<me>/../<victim>/config. The authorization check compares the
first path segment against the authenticated user, while the backend
object key was built from the raw, un-cleaned URL path.

Reject any non-canonical request path so the authorization segment and
the backend object key can no longer disagree.

Fixes GHSA-fqj9-69pf-6pjg

2026-07-08 16:07:11 +01:00

..

about

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

all

gui: new command to launch the https://github.com/rclone/rclone-web/ GUI

2026-04-10 11:39:50 +01:00

archive

archive extract: fix path traversal letting archives escape the destination CVE-2026-59732

2026-07-08 16:05:38 +01:00

authorize

docs: add link from authorize command docs to remote setup docs

2025-10-02 18:46:16 +02:00

backend

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

bisync

bisync: fix --conflict-loser pathname with --conflict-resolve newer

2026-05-11 18:34:02 -04:00

cachestats

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cat

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

check

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

checksum

docs: consistent newline of first line in command output

2024-08-15 18:26:34 +02:00

cleanup

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

cmount

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

config

rclone config string: reduce quoting with Human rendering for strings #8859

2025-10-03 15:54:15 +01:00

convmv

build: use "for i := range n", added in go1.22

2025-09-15 12:45:57 +01:00

copy

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

copyto

docs: clarify copyto command description - Fixes #9527

2026-06-29 18:19:49 +01:00

copyurl

copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.

2026-02-17 11:46:37 +00:00

cryptcheck

fix: comment typos

2025-11-13 13:47:40 +00:00

cryptdecode

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

dedupe

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

delete

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

deletefile

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

genautocomplete

completion: fix powershell completion corrupting non-ASCII names - fixes #9412

2026-06-18 13:28:23 +01:00

gendocs

gendocs: refactor and add logging of skipped command docs

2025-09-02 14:06:31 +02:00

gitannex

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

gui

gui: update embedded release to 1.1.10

2026-06-22 12:04:29 +01:00

hashsum

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

link

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

listremotes

listremotes: add --exact flag for filtering - fixes #9076

2026-04-24 16:23:12 +01:00

ls

docs: mention use of ListR feature in ls docs

2025-12-15 09:11:00 +01:00

lsd

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsf

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

lsjson

docs: fix typos in comments and messages

2026-01-18 20:48:33 +01:00

lsl

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

md5sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

mkdir

docs: group the global flags and make them appear on command and flags pages

2023-08-02 12:53:09 +01:00

mount

mountlib: rc: fix mounts created with mountPoint "*" overwriting each other

2026-04-27 15:09:14 +01:00

mount2

cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets

2026-07-01 16:37:54 +01:00

mountlib

mount2: add --allow-idmap to advertise FUSE_ALLOW_IDMAP

2026-05-25 17:52:36 +01:00

move

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

moveto

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

ncdu

ncdu/scan: add unit tests for the scan package

2026-06-05 18:13:16 +01:00

nfsmount

serve nfs: allow NFS clients to mount subpaths of the served remote

2026-05-24 18:09:03 +01:00

obscure

docs: fix echo command syntax for password input

2026-01-18 20:56:26 +01:00

purge

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rc

rc: flip auth default so all endpoints require auth unless opted out

2026-04-19 13:31:27 +01:00

rcat

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

rcd

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

reveal

docs: add minimum versions to the command pages

2022-12-03 18:58:55 +01:00

rmdir

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

rmdirs

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

selfupdate

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

serve

serve restic: fix --private-repos isolation bypass CVE-2026-59733

2026-07-08 16:07:11 +01:00

settier

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

sha1sum

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

size

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

sync

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

test

test speed: fix formatting of help

2025-11-21 17:02:45 +00:00

touch

touch: add metadata when using --metadata-set

2026-02-26 16:20:24 +00:00

tree

docs: fix markdown lint issues in command docs

2025-08-26 12:04:00 +02:00

version

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

cmd.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

completion.go

cmd: make auto completion work for all shells and reduce the size

2024-02-29 14:46:50 +00:00

help.go

docs: fix markdownlint issues in backend command generated output

2025-11-04 23:00:46 +01:00

progress.go

build: modernize Go code with go fix for go1.25

2026-02-18 12:11:52 +00:00

selfupdate_disabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

selfupdate_enabled.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00

siginfo_bsd.go

build: update logging statements to make json log work - fixes #6038

2024-09-06 17:04:18 +01:00

siginfo_others.go

build: remove build constraint syntax for go 1.16 and older

2024-04-18 16:53:55 +02:00