Rclone Release 1.75.1

Releases
1

Rclone 1.75.1 has been released. Find it in the rclone downloads or use rclone selfupdate to upgrade.

This is a security release to fix CVEs in rclone and rclone dependencies and a selection of other bugs.

v1.75.1 - 2026-09-04

See commits

  • Security
    • archive
      • Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)
      • Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
      • Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    • build
      • Fix multiple CVEs by upgrading to go1.26.6 (Nick Craig-Wood)
        • CVE-2026-56860: net/url: quadratic complexity in resolvePath
        • CVE-2026-56858: html/template: JavaScript regexp context tracking
        • CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
        • CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
        • CVE-2026-56859: encoding/xml: recursion depth guard during decode
        • CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
        • CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
        • CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
      • Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs (Nick Craig-Wood)
        • CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
        • CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
        • CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
      • Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603 (Nick Craig-Wood)
        • CVE-2026-46603: excessive memory allocation during VP8L decoding
    • fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick Craig-Wood)
    • fshttp: Don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
    • http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
    • lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
    • local
      • Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
      • Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
      • Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)
    • serve docker
      • Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
      • Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
      • Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
    • serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)
    • serve s3
      • Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)
      • Reject bogus multipart part sizes in the reorder buffer GHSA-2p48-j3qc-rx9f (Nick Craig-Wood)
      • Fix auth proxy accepting any request signed with an empty secret GHSA-xwwr-4h3p-r22c CVE-PENDING (Nick Craig-Wood)
        • NB the auth proxy protocol for serve s3 has changed - the proxy program is now given the access key ID as user and must return the secret as _secret_access_key
      • Fix each server accepting the --auth-key credentials of all the others (Nick Craig-Wood)
      • Fix misleading anonymous access log when using an auth proxy via rc GHSA-p569-5gjg-9cmj CVE-PENDING (Nick Craig-Wood)
    • serve sftp: Fix auth proxy configured via rc being silently ignored GHSA-p569-5gjg-9cmj CVE-PENDING (Nick Craig-Wood)
  • Bug Fixes
    • accounting
      • Fix memory leak on long-running rcd (nielash)
      • Fix memory leak from stats groups on long-running rcd (nielash)
      • Fix bwlimit burst overflow (Rayan Salhab)
    • bisync
      • Fix memory leak when running via the rc (nielash)
      • Fix failed transfers of empty files being recorded as synced (Nick Craig-Wood)
    • build: Make go1.26 the minimum required version as needed by golang.org/x/crypto v0.56.0 (Nick Craig-Wood)
    • config: Redact env var config values in logs (Pastalikek65)
    • doc fixes (Anton Karpov, CAOShurong, Dean Chen, Nick Craig-Wood, Recoordinate, Rodrigo Rodrigues, Shantanav Mukherjee, shaurya)
    • lib/batcher: Prevent commits racing shutdown (Loi Nguyen)
    • lib/transform: Fix panic in truncate_keep_extension (VXNCXNX)
    • multipart: Fix chunked uploads storing truncated objects when the source ends early (Nick Craig-Wood)
    • operations: Fix silent truncation of streaming uploads whose source ends early (Nick Craig-Wood)
    • serve
      • Fix VFS instance leaks on server startup failures and shutdown (Hakan İSMAİL)
      • Pass the client IP address to the auth proxy (am-at-enrollvb)
    • serve http: Prevent scrolling to the top on page reload (Sune Mølgaard)
    • serve nfs: Fix EIO when creating symlinks with --vfs-links (SillyZir)
    • serve s3
      • Fix failed uploads deleting or corrupting the object at the key (Nick Craig-Wood)
      • Fix crash when a multipart upload is aborted while a part is uploading (Nick Craig-Wood)
      • Fix modtime not being set when only mtime metadata is supplied on PUT (Nick Craig-Wood)
      • Upload all multipart uploads via the VFS so they obey --bwlimit and show in stats (Nick Craig-Wood)
      • Reserve the .rclone_temp_ prefix for temporary objects (Nick Craig-Wood)
      • Clean up abandoned multipart uploads after --multipart-expiry (Nick Craig-Wood)
    • vfscache
      • Fix reader deadlock when the item size drops below the read offset (Dave)
      • Fix log message growing without bound on repeated write errors (Vijay Misal)
    • walk: Stop directory traversal when the context is cancelled (Rahman Yilmaz)
  • VFS
    • Synchronize poll updates with shutdown (Loi Nguyen)
    • Make poll shutdown lifecycle deterministic (Loi Nguyen)
  • Crypt
    • Fix hash mismatches with no_data_encryption on backends which check upload hashes (Nick Craig-Wood)
    • Fix directory names which look like versioned file names (TowyTowy)
    • Warn about directories with legacy version-like encrypted names (Nick Craig-Wood)
  • Azure Blob
    • Fix Entra ID server-side copy source authentication (Edward Klesel)
    • Fix spurious vfs cache corruption errors during chunked reads (Nick Craig-Wood)
  • Azurefiles
    • Fix zero padded files being created when the source ends early (Nick Craig-Wood)
  • Box
    • Fix truncated files being uploaded successfully when the source ends early (Rohit Behera)
  • Compress
    • Fix corrupted objects being created when the source ends early (Nick Craig-Wood)
  • Drive
    • Don't list trashed files when removing a directory into the trash (alliasgher)
  • Dropbox
    • Preserve Paper export paths on lookup (Loi Nguyen)
    • Fix context cancellation (e.g. --max-duration limit) not stopping in-flight requests (debaditya)
    • Fix chunked uploads of truncated files never finishing (Nick Craig-Wood)
    • Don't retry chunked upload requests when the upload has been cancelled (Nick Craig-Wood)
    • Decode received shared-file names (Sanjay Kanth A)
    • Fix ChangeNotify when the root's case differs from Dropbox's (Loi Nguyen)
  • Filelu
    • Fix truncated files being uploaded successfully when the source ends early (Nick Craig-Wood)
    • Fix duplicate root path during multipart folder creation (kingston125)
  • Huaweidrive
    • Fix truncated files being uploaded successfully when the source ends early (Rohit Behera)
  • Iclouddrive
    • Fix uploads into an app container failing with 412 (Christian De Santis)
  • Internetarchive
    • Fix corrupted files being created when the source ends early (Nick Craig-Wood)
  • Internxt
    • Persist rotated token returned by the user info call (0rangeSeaW0lf)
  • Onedrive
    • Fix 403 Forbidden for configuration personal onedrive (machsix)
    • Fall back to manual drive ID entry when drive listing fails (SillyZir)
    • Don't retry multipart upload chunk on 404 (upload session not found) (water)
  • Overview
    • Fix "internal error: no overview data found" on 32 bit architectures (Nick Craig-Wood)
  • Pikpak
    • Fix truncated files being created when the source ends early (Nick Craig-Wood)
    • Fix truncated single part uploads reported as ok when source ends early (Nick Craig-Wood)
  • Protondrive
    • Fix files uploaded with v1.75.0 not being readable in the Proton apps (Nick Craig-Wood)
    • Fix corrupted uploads after a retried upload error (Nick Craig-Wood)
  • Quatrix
    • Fix chunk upload retries and fix memory leak (Nick Craig-Wood)
  • S3
    • Update Mega endpoints (Nick Craig-Wood)
    • Treat UploadPart success without ETag as retryable error (CAOShurong)
    • Fix server side copy failing with --s3-no-head-object (Anatoly Tarnavsky)
  • Sia
    • Fix corrupted files being created when the source ends early (Nick Craig-Wood)
  • Smb
    • Reuse the upload connection for SetModTime (alliasgher)
  • WebDAV
    • Fix SetModTime failing and hashes missing on Nextcloud (Nick Craig-Wood)
  • Yandex
    • Fix truncated files being uploaded successfully when the source ends early (Rohit Behera)
4 Likes