Rclone Release 1.74.3

Releases
1

Rclone 1.74.3 has been released. Find it in the rclone downloads or use rclone selfupdate to upgrade.

This is a security release to fix CVEs in rclone and rclone dependencies and a few other small things.

v1.74.3 - 2026-06-05

See commits

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
      • See GHSA-qw24-gh76-8rvv for more info
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split candidate hostname only once
    • log: Fix wrong source file:line in JSON logs from release builds (Nick Craig-Wood)
    • mount2: Fix empty directory listings on re-read (Janne Beate Bakeng)
    • serve s3: Fix multipart ListParts pagination returning wrong part numbers (Nick Craig-Wood)
    • serve sftp
      • Fix file corruption when a client resumes an upload (Nick Craig-Wood)
      • Fix truncate request being silently ignored (Nick Craig-Wood)
  • Local
    • Fix getXattr returning empty map instead of nil (Leon Brocard)
  • Drime
    • Fix server-side copy and move failing with Cloudflare 520 error (Nick Craig-Wood)
    • Fix files being uploaded to the wrong directory (Nick Craig-Wood)
    • Remove duplicate upload_cutoff config option (Nick Craig-Wood)
    • Fix directory rename leaving the renamed folder empty in VFS (Nick Craig-Wood)
  • Drive
    • Fix server-side move failing on shared drives with duplicate dirs (Nick Craig-Wood)
  • Iclouddrive
    • Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)
    • Fix "Index has invalid data" error listing iCloud Photos (Nick Craig-Wood)
5 Likes
3

UPDATE: Fixed

Just FYI, as of 2026-06-05T10:48:51-06:00 (2026-06-05T16:4851Z), rclone selfupdate is not working

$ rclone version
rclone v1.74.2
- os/version: darwin 15.6.1 (64 bit)
- os/kernel: 24.6.0 (arm64)
- os/type: darwin
- os/arch: arm64 (ARMv8 compatible)
- go/version: go1.26.3
- go/linking: dynamic
- go/tags: cmount
 
$ rclone selfupdate
2026/06/05 10:50:03 NOTICE: rclone is up to date

And on my VPS:

$ rclone version
rclone v1.74.2
- os/version: debian 13.5 (64 bit)
- os/kernel: 6.12.90+deb13.1-cloud-amd64 (x86_64)
- os/type: linux
- os/arch: amd64
- go/version: go1.26.3
- go/linking: static
- go/tags: none

$ rclone selfupdate
2026/06/05 10:50:50 NOTICE: rclone is up to date
4

same issue on windows