# rclone v1.75.1 — rclone v1.75.1

- Product: rclone (https://whatsnew.fyi/product/rclone)
- Vendor: rclone
- Date: 2026-09-04
- Version: v1.75.1
- Original notes: https://github.com/rclone/rclone/releases/tag/v1.75.1
- Permalink: https://whatsnew.fyi/product/rclone/releases/v1.75.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix zip slip path traversal in untrusted zip files
- **security** — Hide any archive entry which escapes the directory being listed
- **security** — Reject unsafe entry names when mounting squashfs images
- **security** — Fix zip subdirectory root matching sibling directories
- **security** — Fix zip entry named "." hiding every other file
- **security** — Fix "directory not found" for archive paths containing "./" or "//"
- **security** — Upgrade to go1.26.6 to fix multiple CVEs including quadratic complexity in net/url, JavaScript regexp context tracking, TLS handshake message limits, HTTP/2 timeout handling, XML recursion depth guards, ASN.1 recursion depth limits, DNS message parsing panic, and Punycode validation
- **security** — Update golang.org/x/crypto to v0.56.0 to fix SSH source-address critical option enforcement, SSH channel flooding deadlock, and SSH crafted message deadlock
- **security** — Update golang.org/x/image to v0.45.0 to fix excessive memory allocation during VP8L decoding
- **security** — Confine directory listing entries that escape the root
- **security** — Don't send --header values to other hosts on redirect
- **security** — Don't leak configured headers to other hosts or over plaintext on redirect
- **security** — Check HTTPS downgrades against the original request on redirect
- **security** — Fix dir metadata escaping the root through a planted symlink
- **security** — Fix btime escaping the root via a planted symlink
- **security** — Fix panic on Range request past the end of a symlink
- **security** — Reject volume names that escape the base directory in serve docker
- **security** — Reject volume names resolving to the base directory itself in serve docker
- **security** — Re-derive volume mountpoint from name when restoring state in serve docker

[See commits](https://github.com/rclone/rclone/compare/v1.75.0...v1.75.1)

- Security
  - archive
    - Fix zip slip path traversal in untrusted zip files GHSA-66hp-wgxq-6f5q CVE-PENDING (Nick Craig-Wood)
    - Hide any archive entry which escapes the directory being listed GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    - Reject unsafe entry names when mounting squashfs images GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    - Fix zip subdirectory root matching sibling directories GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    - Fix zip entry named "." hiding every other file GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
    - Fix "directory not found" for archive paths containing "./" or "//" GHSA-66hp-wgxq-6f5q (Nick Craig-Wood)
  - build
    - Fix multiple CVEs by upgrading to go1.26.6 (Nick Craig-Wood)
      - CVE-2026-56860: net/url: quadratic complexity in resolvePath
      - CVE-2026-56858: html/template: JavaScript regexp context tracking
      - CVE-2026-56862: crypto/tls: limit handshake messages accepted post-handshake
      - CVE-2026-56853: net/http: apply ReadHeaderTimeout to unencrypted HTTP/2 check
      - CVE-2026-56859: encoding/xml: recursion depth guard during decode
      - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
      - CVE-2026-46600: net: panic parsing an invalid SVCB or HTTPS RR in dnsmessage
      - CVE-2026-39821: net/http: reject ASCII-only Punycode-encoded labels in idna
    - Update golang.org/x/crypto to v0.56.0 to fix multiple CVEs (Nick Craig-Wood)
      - CVE-2026-56854: ssh: source-address critical option not enforced for non-public-key auth callbacks
      - CVE-2026-78662: ssh: a malicious peer could flood an undecided channel's incoming requests, deadlocking the connection
      - CVE-2026-56855: ssh: a malicious peer could send crafted messages on an established channel, deadlocking the connection
    - Update golang.org/x/image to v0.45.0 to fix CVE-2026-46603 (Nick Craig-Wood)
      - CVE-2026-46603: excessive memory allocation during VP8L decoding
  - fs: Confine directory listing entries that escape the root GHSA-3vxh-3pcx-9m8q GHSA-38xv-hf3p-h7mq CVE-PENDING (Nick Craig-Wood)
  - fshttp: Don't send `--header` values to other hosts on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
  - http: Don't leak configured headers to other hosts or over plaintext on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
  - lib/rest: Check HTTPS downgrades against the original request on redirect GHSA-486v-q2wf-fp2r CVE-PENDING (Nick Craig-Wood)
  - local
    - Fix dir metadata escaping the root through a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
    - Fix btime escaping the root via a planted symlink GHSA-f8g7-2xjc-7mfh CVE-PENDING (Nick Craig-Wood)
    - Fix panic on Range request past the end of a symlink GHSA-p6m2-r3w9-mpxw CVE-PENDING (Nick Craig-Wood)
  - serve docker
    - Reject volume names that escape the base directory GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
    - Reject volume names resolving to the base directory itself GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
    - Re-derive volume mountpoint from name when restoring state GHSA-p6vx-hf7p-98j6 (Nick Craig-Wood)
  - serve ftp: Fix auth-proxy sessions sharing credentials by username GHSA-c476-6w5q-jw77 CVE-PENDING (Nick Craig-Wood)
  - serve s3
    - Fix memory exhaustion from client-declared multipart part size GHSA-2p48-j3qc-rx9f CVE-PENDING (Nick Craig-Wood)
    - Reject bogus multipart part sizes in the reorder buffer GHSA-2p48-j3qc-rx9f (Nick Craig-Wood)
    - Fix auth proxy accepting any request signed with an empty secret GHSA-xwwr-4h3p-r22c CVE-PENDING (Nick Craig-Wood)
      - **NB** the auth proxy protocol for `serve s3` has changed - the proxy program is now given the access key ID as `user` and must return the secret as `_secret_access_key`
    - Fix each server accepting the `--auth-key` credentials of all the others (Nick Craig-Wood)
    - Fix misleading anonymous access log when using an

_[Truncated at 4000 characters — full notes: https://github.com/rclone/rclone/releases/tag/v1.75.1]_