structs

Jul 31, 2026 GO-2026-6456 +8 more

  GO-2026-6456: rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Jul 8, 2026 GO-2026-6181 +16 more

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Jun 5, 2026 GO-2026-6181 +22 more

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

May 22, 2026 GO-2026-5596 +23 more

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

May 8, 2026 GO-2026-5596 +23 more

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

May 1, 2026 GO-2026-5596 +23 more

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Apr 19, 2026 GO-2026-5596 +23 more

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Apr 8, 2026 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Mar 23, 2026 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Mar 6, 2026 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Feb 17, 2026 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Jan 30, 2026 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Dec 10, 2025 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Nov 21, 2025 GO-2026-4964 +25 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone

Oct 20, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 24, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Aug 22, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jul 9, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jul 23, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 27, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 19, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 17, 2025 GO-2026-4964 +24 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

May 21, 2025 GO-2026-4964 +23 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

May 1, 2025 GO-2026-4964 +23 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Feb 14, 2025 GO-2026-4964 +23 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jan 12, 2025 GO-2026-4964 +23 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Nov 15, 2024 GO-2026-4964 +23 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 24, 2024 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 8, 2024 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 14, 2024 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 10, 2024 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jan 24, 2024 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jan 8, 2024 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Nov 26, 2023 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Oct 19, 2023 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Oct 17, 2023 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 11, 2023 GO-2024-3271 +24 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jul 17, 2023 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 30, 2023 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 16, 2023 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 15, 2023 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 14, 2023 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Dec 23, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Dec 20, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Nov 17, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Oct 21, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 15, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Aug 8, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jul 9, 2022 GO-2024-3271 +23 more

  GO-2024-3271: Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Apr 29, 2022 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 18, 2022 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Nov 1, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Oct 1, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 19, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jul 20, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Apr 26, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 31, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Mar 8, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Feb 2, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jan 20, 2021 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Nov 19, 2020 GO-2026-4964 +22 more

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Oct 26, 2020 GO-2022-0878 +23 more

  GO-2022-0878: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 13, 2020 GO-2022-0878 +23 more

  GO-2022-0878: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Sep 2, 2020 GO-2022-0878 +23 more

  GO-2022-0878: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Aug 7, 2020 GO-2022-0878 +23 more

  GO-2022-0878: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 24, 2020 GO-2022-0878 +23 more

  GO-2022-0878: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Jun 10, 2020 GO-2022-0878 +23 more

  GO-2022-0878: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone in github.com/rclone/rclone

  GO-2026-4964: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution in github.com/rclone/rclone

  GO-2026-5466: Unauthenticated backend instantiation in github.com/rclone/rclone

  GO-2026-5596: Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

  GO-2026-6181: Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone

  GO-2026-6182: Command execution via PowerShell smart quotes in github.com/rclone/rclone

  GO-2026-6183: Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

  GO-2026-6184: Path traversal in serve restic in github.com/rclone/rclone

  GO-2026-6185: Path traversal via crafted archive paths in github.com/rclone/rclone

  GO-2026-6186: Path traversal via local backend encoding in github.com/rclone/rclone

  GO-2026-6187: FTP command injection via custom encoding in github.com/rclone/rclone

  GO-2026-6188: S3 redirect sanitization omits sensitive headers in github.com/rclone/rclone

  GO-2026-6189: Path traversal in serve s3 in github.com/rclone/rclone

  GO-2026-6190: Unsafe file permission restoration from metadata in github.com/rclone/rclone

  GO-2026-6191: Arbitrary file write via --links symlinks in github.com/rclone/rclone

  GO-2026-6195: Authorization bypass in serve restic in github.com/rclone/rclone

  GO-2026-6196: S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6197: WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

  GO-2026-6199: Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

Changes in this version

+ func SetDefaults(a, b interface{})

+ func SetFrom(a, b interface{})