Rclone

What's new in this version:

Security:
archive:
- Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING
- Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q
- Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q
- Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q
- Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q
- Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q

build:
- Fix multiple CVEs by upgrading to go1.26.6
- CVE-2026-56860: net/url: quadratic complexity in resolvePath
- CVE-2026-56858: html/template: JavaScript regexp context tracking
- CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
- CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
- CVE-2026-56859: encoding/xml: recursion depth guard during decode
- CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
- CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
- CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
- Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs
- CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
- CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
- CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
- Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603
- CVE-2026-46603: excessive memory allocation during VP8L decoding
- fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING
- fshttp: Don't send --header values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING
- http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING
- lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING

local:
- Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING
- Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING
- Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING

serve docker:
- Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6
- Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6
- Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6
- serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING

serve s3:
- Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING
- Reject bogus multipart part sizes in the reorder buffer GHSA-2p48-j3qc-rx9f
- Fix auth proxy accepting any request signed with an empty secret GHSA-xwwr-4h3p-r22c CVE-PENDING
- NB the auth proxy protocol for serve s3 has changed - the proxy program is now given the access key ID as user and must return the secret as _secret_access_key
- Fix each server accepting the --auth-key credentials of all the others
- Fix misleading anonymous access log when using an auth proxy via rc GHSA-p569-5gjg-9cmj CVE-PENDING
- serve sftp: Fix auth proxy configured via rc being silently ignored GHSA-p569-5gjg-9cmj CVE-PENDING

Bug Fixes:
accounting:
- Fix memory leak on long-running rcd
- Fix memory leak from stats groups on long-running rcd
- Fix bwlimit burst overflow

bisync:
- Fix memory leak when running via the rc
- Fix failed transfers of empty files being recorded as synced
- build: Make go1.26 the minimum required version as needed by golang.org/x/crypto v0.56.0
- config: Redact env var config values in logs
- doc fixes
- lib/batcher: Prevent commits racing shutdown
- lib/transform: Fix panic in truncate_keep_extension
- multipart: Fix chunked uploads storing truncated objects when the source ends early
- operations: Fix silent truncation of streaming uploads whose source ends early

serve:
- Fix VFS instance leaks on server startup failures and shutdown
- Pass the client IP address to the auth proxy
- serve http: Prevent scrolling to the top on page reload
- serve nfs: Fix EIO when creating symlinks with --vfs-links

serve s3:
- Fix failed uploads deleting or corrupting the object at the key
- Fix crash when a multipart upload is aborted while a part is uploading
- Fix modtime not being set when only mtime metadata is supplied on PUT
- Upload all multipart uploads via the VFS so they obey --bwlimit and show in stats
- Reserve the .rclone_temp_ prefix for temporary objects
- Clean up abandoned multipart uploads after --multipart-expiry

vfscache:
- Fix reader deadlock when the item size drops below the read offset
- Fix log message growing without bound on repeated write errors
- walk: Stop directory traversal when the context is cancelled

VFS:
- Synchronize poll updates with shutdown
- Make poll shutdown lifecycle deterministic

Crypt:
- Fix hash mismatches with no_data_encryption on backends which check upload hashes
- Fix directory names which look like versioned file names
- Warn about directories with legacy version-like encrypted names

Azure Blob:
- Fix Entra ID server-side copy source authentication
- Fix spurious vfs cache corruption errors during chunked reads

Azurefiles:
- Fix zero padded files being created when the source ends early

Box:
- Fix truncated files being uploaded successfully when the source ends early

Compress:
- Fix corrupted objects being created when the source ends early

Drive:
- Don't list trashed files when removing a directory into the trash

Dropbox:
- Preserve Paper export paths on lookup
- Fix context cancellation
- Fix chunked uploads of truncated files never finishing
- Don't retry chunked upload requests when the upload has been cancelled
- Decode received shared-file names
- Fix ChangeNotify when the root's case differs from Dropbox's

Filelu:
- Fix truncated files being uploaded successfully when the source ends early
- Fix duplicate root path during multipart folder creation

Huaweidrive:
- Fix truncated files being uploaded successfully when the source ends early

Iclouddrive:
- Fix uploads into an app container failing with 412

Internetarchive:
- Fix corrupted files being created when the source ends early

Internxt:
- Persist rotated token returned by the user info call

Onedrive:
- Fix 403 Forbidden for configuration personal onedrive
- Fall back to manual drive ID entry when drive listing fails
- Don't retry multipart upload chunk on 404

Overview:
- Fix "internal error: no overview data found" on 32 bit architectures

Pikpak:
- Fix truncated files being created when the source ends early
- Fix truncated single part uploads reported as ok when source ends early

Protondrive:
- Fix files uploaded with v1.75.0 not being readable in the Proton apps
- Fix corrupted uploads after a retried upload error

Quatrix:
- Fix chunk upload retries and fix memory leak

S3:
- Update Mega endpoints
- Treat UploadPart success without ETag as retryable error
- Fix server side copy failing with --s3-no-head-object

Sia:
- Fix corrupted files being created when the source ends early

Smb:
- Reuse the upload connection for SetModTime

WebDAV:
- Fix SetModTime failing and hashes missing on Nextcloud

Yandex:
- Fix truncated files being uploaded successfully when the source ends early