rclone

mirror of https://github.com/rclone/rclone.git synced 2026-07-12 16:55:58 -04:00

Files

Nick Craig-Wood dade21c161 serve restic: fix --private-repos isolation bypass CVE-2026-59733

A user could reach another user's private repository by sending a path
such as /<me>/../<victim>/config. The authorization check compares the
first path segment against the authenticated user, while the backend
object key was built from the raw, un-cleaned URL path.

Reject any non-canonical request path so the authorization segment and
the backend object key can no longer disagree.

Fixes GHSA-fqj9-69pf-6pjg

2026-07-08 16:07:11 +01:00

dlna

serve dlna: remove file extensions from titles to prevent Samsung TV duplication

2026-04-24 16:27:09 +01:00

docker

docs: change syntax hightlighting for command examples from sh to console

2025-11-01 15:33:38 +01:00

ftp

vfs: add context parameter to New() for config propagation

2026-04-13 12:48:38 +01:00

http

serve/http: fix --disable-zip so it works over rc