{"schema_version":"1.7.5","id":"openSUSE-SU-2026:21436-1","published":"2026-07-22T20:54:49Z","modified":"2026-07-24T17:16:08.404400958Z","related":["CVE-2025-68121","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27141","CVE-2026-27145","CVE-2026-32952","CVE-2026-33809","CVE-2026-33813","CVE-2026-33814","CVE-2026-39821","CVE-2026-39824","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41176","CVE-2026-41179","CVE-2026-42500","CVE-2026-42502","CVE-2026-42504","CVE-2026-42506","CVE-2026-42507","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-49980","CVE-2026-54572","CVE-2026-59732","CVE-2026-59733"],"upstream":["CVE-2025-68121","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27141","CVE-2026-27145","CVE-2026-32952","CVE-2026-33809","CVE-2026-33813","CVE-2026-33814","CVE-2026-39821","CVE-2026-39824","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41176","CVE-2026-41179","CVE-2026-42500","CVE-2026-42502","CVE-2026-42504","CVE-2026-42506","CVE-2026-42507","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-49980","CVE-2026-54572","CVE-2026-59732","CVE-2026-59733"],"summary":"Security update for rclone","details":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.74.4 (boo#1267192):\n  * Version v1.74.4\n  * gui: update embedded release to 1.1.10\n  * local: stop --links symlinks escaping the destination directory CVE-2026-54572\n  * local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw\n  * s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc\n  * serve restic: fix --private-repos isolation bypass CVE-2026-59733\n  * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732\n  * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v\n  * build: fix multiple CVEs by upgrading to go1.26.5\n  * s3: fix mounting a prefix failing with 403 when HEAD is not permitted\n  * drive, googlephotos: warn when using rclone's shared client_id #9580\n  * drive: fix stray %!(EXTRA) in unexportable google document log message\n  * serve/http: fix --disable-zip so it works over rc\n  * serve webdav: fix MOVE overwrite failing without Overwrite header\n  * fs: fix negative offset when a suffix Range request exceeds object size\n  * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs\n  * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets\n  * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers\n  * cmd/mount2: fix NFS file creation by implementing Mknod\n  * smb: fix for IBM iSeries and signature verification\n  * mega: fix hard deleted files reappearing in listings - fixes #9554\n  * mega: wait for server events after upload, delete and move\n  * vfs: fix hang reopening a file during the handle-caching grace period\n  * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391\n  * fs: fix command line flag being ignored when set to its default value\n  * docs: fix copy to clipboard functionality for code blocks\n  * fs/operations: correct DeleteFile --backup-dir documentation\n  * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities\n  * docs: clarify copyto command description - Fixes #9527\n  * docs: fix typo in remote setup docs\n  * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188\n  * * s3: fix error mapping in GetObject to match HeadObject\n  * filter: fix --files-from copy stopping at the first unreadable file\n  * docs: Fix RELEASE.md\n  * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0\n  * completion: fix powershell completion corrupting non-ASCII names - fixes #9412\n  * docs/crypt: fix encrypted size example - Fixes #9202\n  * docs: drive: note Google verification exemption for personal use apps\n  * rc: document that rc API access is equivalent to shell access\n  * docs: drive: update documentation about \"Computers\" folder\n  * accounting: fix goroutine leak in ResetCounters\n  * docs: fix --windows-event-log-level help\n  * backend/filelu: fix recursive listing path handling and file filtering\n  * docs: bisync - clarify flag interaction and minor changes\n  * docs: Update RELEASE.md to use cherry-pick -x\n  * webdav: fix mixed property statuses in multi-status responses\n  * s3: remove session token on cross-host redirects\n  * drive: warn when non-exportable Google documents are skipped - #9475\n  * Start v1.74.4-DEV development\n\n- update x/image to 0.43 (bsc#1271056)\n\n- Update to version 1.74.3: (boo#1267869)\n  - Bug Fixes\n    - rc\n      - Fix unauthenticated command execution via --rc-serve inline\n        remotes CVE-2026-49980 (Nick Craig-Wood)\n      - Stop global.* connection string options changing config\n        CVE-2026-49980 (Nick Craig-Wood)\n    - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick\n      Craig-Wood)\n      - CVE-2026-42504: mime: quadratic complexity in\n        WordDecoder.DecodeHeader\n      - CVE-2026-42507: net/textproto: arbitrary input are included\n        in errors without any escaping\n      - CVE-2026-27145: crypto/x509: split candidate hostname only\n        once\n    - log: Fix wrong source file:line in JSON logs from release\n      builds (Nick Craig-Wood)\n    - mount2: Fix empty directory listings on re-read (Janne Beate\n      Bakeng)\n    - serve s3: Fix multipart ListParts pagination returning wrong\n      part numbers (Nick Craig-Wood)\n    - serve sftp\n      - Fix file corruption when a client resumes an upload (Nick\n        Craig-Wood)\n      - Fix truncate request being silently ignored (Nick\n        Craig-Wood)\n    - Local\n      - Fix getXattr returning empty map instead of nil (Leon\n        Brocard)\n  - Drime\n    - Fix server-side copy and move failing with Cloudflare 520\n      error (Nick Craig-Wood)\n    - Fix files being uploaded to the wrong directory (Nick\n      Craig-Wood)\n    - Remove duplicate upload_cutoff config option (Nick\n      Craig-Wood)\n    - Fix directory rename leaving the renamed folder empty in VFS\n      (Nick Craig-Wood)\n  - Drive\n    - Fix server-side move failing on shared drives with duplicate\n      dirs (Nick Craig-Wood)\n  - Iclouddrive\n    - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)\n    - Fix \"Index has invalid data\" error listing iCloud Photos\n      (Nick Craig-Wood)\n\n- Update to version 1.74.2: (boo#1266210)\n  - Bug Fixes\n    - build\n      - Update golang.org/x/net to v0.55.0 to address:\n        - CVE-2026-42506: html: incorrect handling of namespaced\n          elements in foreign content\n        - CVE-2026-39821: idna: failure to reject ASCII-only\n          Punycode-encoded labels\n        - CVE-2026-42502: html: incorrect handling of HTML elements\n          in foreign content\n        - CVE-2026-25680: html: denial of service when parsing\n          arbitrary HTML\n        - CVE-2026-25681: html: incorrect handling of character\n          references in DOCTYPE nodes\n        - CVE-2026-27136: html: duplicate attributes can cause XSS\n      - Update golang.org/x/crypto to v0.52.0 to address:\n        - CVE-2026-46598: ssh/agent: pathological inputs can lead\n          to client panic\n        - CVE-2026-46597: ssh: byte arithmetic causes underflow and\n          panic\n        - CVE-2026-39828: ssh: bypass of certificate restrictions\n        - CVE-2026-39835: ssh: server panic during\n          CheckHostKey/Authenticate\n        - CVE-2026-39833: ssh/agent: key constraints not enforced\n        - CVE-2026-39832: ssh/agent: agent constraints dropped when\n          forwarding keys\n        - CVE-2026-39827: ssh: memory leak when rejecting channels\n          can lead to DoS\n        - CVE-2026-39830: ssh: client can cause server deadlock on\n          unexpected responses\n        - CVE-2026-39829: ssh: pathological RSA/DSA parameters may\n          cause DoS\n        - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys\n          physical interaction\n        - CVE-2026-39834: ssh: infinite loop on large channel\n          writes\n        - CVE-2026-42508: ssh/knownhosts: auth bypass via\n          unenforced @revoked status\n        - CVE-2026-46595: ssh: VerifiedPublicKeyCallback\n          permissions skip enforcement\n      - update golang.org/x/image to v0.41.0 to address:\n        - CVE-2026-42500: bmp: panic when reading out of bound\n          palette index\n        - CVE-2026-33809: tiff: excessive resource consumption in\n          PackBits decompression\n      - Update golang.org/x/sys to version v0.45.0 to address:\n        - CVE-2026-39824: windows: integer overflow in\n          NewNTUnicodeString\n      - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix\n        CVE-2026-44740\n      - bisync: Fix --conflict-loser pathname with\n        --conflict-resolve newer (nielash)\n      - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)\n      - lib/http: Replace deprecated h2c.NewHandler with\n        http.Server.Protocols (Nick Craig-Wood)\n      - rc: Remove duplicate metrics_addr option registration (Nick\n        Craig-Wood)\n      - vfs/vfscache: Fix silent write failure when mounting with\n        remote:. (Lucky945H)\n    - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)\n  - Drime\n    - Fix file doesn't exists error when trying to delete (John\n      Volk)\n    - Fix 500 errors when listing shared folders (Alvinwylim)\n  - Jottacloud\n    - Support whitelabel service Phonero Sky (Tore Anderson)\n  - Protondrive\n    - Fix corrupted on transfer: sha1 hashes differ (William Tange)\n  - S3\n    - Add new MEGA S4 endpoints on megas4.com including\n      Asia-Pacific region (Nick Craig-Wood)\n  - WebDAV\n    - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)\n\n- Update to version 1.74.1:\n  * Version v1.74.1\n  * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814\n  * build: fix multiple CVEs by upgrading to go1.26.3\n  * drime: fix uploads of 100..200M files\n  * drime: fix large file uploads landing in drive root instead of configured folder\n  * docs: sponsor updates\n  * s3: add new Fastly Object Storage regions\n  * cloudinary: fix retrying every error and fix pacer sleep units\n  * s3: fix STS call per request by caching AssumeRole credentials\n  * protondrive: fix segfault when copying files missing revision metadata\n  * protondrive: route library logging through rclone's logger\n  * protondrive: route HTTP through rclone's transport\n  * bisync: fix retryable without --resync error message when --resync has a critical failure\n  * cmd/serve/s3: return object listings in key order\n  * Start v1.74.1-DEV development\n\n- Update to version 1.74.0:\n  * Version v1.74.0\n  * docs: add missing Huawei Drive docs\n  * Add Huawei Drive support\n  * s3: add Impossible Cloud as a new S3 provider\n  * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI\n  * gui: embed compressed dist.zip in the binary for smaller, reproducible builds\n  * docs: update the GUI docs to reflect the new `rclone gui`\n  * Add John Volk to contributors\n  * drime: fix listings of large directories\n  * docs: fix iCloud docs after website update (missed in the merge)\n  * protondrive: fix server-side moveto and DirMove against current API\n  * build: Update all packages with pseudo versions which aren't v0.0.0\n  * Add Chris Coughlan to contributors\n  * Add Yakov Till to contributors\n  * iclouddrive: add read only  iCloud Photos support and SRP authentication\n  * mountlib: rc: fix mounts created with mountPoint \"*\" overwriting each other\n  * vfs/vfscache/downloaders: kick waiters periodically, not just once\n  * rc: add user directories to core/disks and filter mounts better\n  * docs: notes on how to update pseudo versions\n  * Add dlaumen to contributors\n  * Add Luke Cyca to contributors\n  * Add mathieulongtin to contributors\n  * protondrive: update to latest go-proton-api to use new host\n  * docs: amend Google Drive client_id instructions to include running web-based auth flow\n  * azureblob,azurefile: fix documentation about federated identity\n  * internxt: implement multi-part uploads\n  * serve dlna: remove file extensions from titles to prevent Samsung TV duplication\n  * serve dlna: fix XML quote escaping for Samsung TV compatibility\n  * serve dlna: handle empty ObjectID from Samsung TVs\n  * serve dlna: add Samsung-specific XML namespace\n  * serve dlna: fix invalid dc:date for containers\n  * serve dlna: fix container childCount to reflect actual contents\n  * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility\n  * Add Anton Bordwine to contributors\n  * listremotes: add --exact flag for filtering - fixes #9076\n  * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952\n  * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367\n  * Add tdawe to contributors\n  * Add Jan Heylen to contributors\n  * protondrive: align backend with newer Proton SDK stack\n  * s3: fix bucket creation failing on Ceph/radosgw\n  * rc: add core/disks to enumerate attached disks\n  * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813\n  * Add SyoBoN to contributors\n  * docs: fix typo\n  * docs: fix code comment regarding cmount tag\n  * s3: add HCP provider and list_versions_oldest_first quirk\n  * mega: fix crash when logging in with previous auth keys fails\n  * pcloud: fix recursive listing from the root - fixes #9315\n  * rc: flip auth default so all endpoints require auth unless opted out\n  * Changelog updates from Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * accounting: fix rcat/copyurl for files.com\n  * bisync: fix integration tests after sftp log changes\n  * build: bump actions/github-script from 8 to 9\n  * fstest/test_all: stop test servers on signal, panic, or exit\n  * fstest/testserver: add CleanupAll for end-of-run server sweep\n  * fstest/testserver: add force-stop and reconcile stale refcounts\n  * fshttp: add --dump curl for dumping HTTP requests as curl commands\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * serve nfs: fix EOF flag in READ response not being set when read reaches end of file\n  * webdav: optimize performance by using Depth=0 for metadata requests\n  * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy\n  * azureblob: add --azureblob-decompress flag to download gzip-encoded files\n  * docs: serve backend metadata as JSON on the website\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * vfs: add context parameter to New() for config propagation\n  * vfs: replace context.TODO/Background with stored VFS context\n  * build: fix `make fetch-gui` in CI workflow - it was in the wrong place\n  * gui: join Wait goroutines on shutdown\n  * gui: remove flag.Lookup test guard around browser open\n  * gui: drop freePort helper, use libhttp port binding for the RC server\n  * gui: allow serving from a local zip file or an unpacked directory\n  * gui: don't run fetch-gui on make\n  * build: fix GitHub API rate limit errors when fetching GUI dist in CI\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filen: make multi-threaded upload chunks individually retryable\n  * chore: add Enduriel as filen backend maintainer\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * Add Mozi to contributors\n  * Add Brais Couce to contributors\n  * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails\n  * iclouddrive: fix 'directory not found' error when the directory contains accent marks\n  * downloaders: fix flaky TestDownloaders/EnsureDownloader test\n  * sftp: warn the user if no host key validation is configured\n  * Add TheBabu to contributors\n  * lib/http: Add HTTP/2 cleartext support in server configuration\n  * build: add explicit permissions to GitHub Actions workflows\n  * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file\n  * webdav: Add a section on symlink/junction points in the help\n  * Changelog updates from Version v1.73.4\n  * build: update all dependencies\n  * docs: fix XSS vulnerability in dropdown mobile header\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * linkbox: fix downloading files by using web API - fixes #8665\n  * vfs: fix tests after --vfs-handle-caching\n  * Add Suyun to contributors\n  * build: fix loong64 and s390x build\n  * jottacloud: add encoding of percent character to default backend encoding\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * vfs: fix slow nfs serve by adding --vfs-handle-caching\n  * Add Xiangzhe to contributors\n  * Add Mike GIllan to contributors\n  * fix(docs): Fix link to not be language specific\n  * iclouddrive: lowercase Apple ID for SRP authentication\n  * iclouddrive: use dynamic origin for SRP auth headers\n  * iclouddrive: replace plaintext signin with SRP authentication\n  * docs: modernize rclone.org site design\n  * Add Andriy Senyshyn to contributors\n  * Add Claude Opus 4.6 to contributors\n  * Add jinyu.han to contributors\n  * Add jinkeyuu to contributors\n  * Add lif to contributors\n  * Add BizaNator to contributors\n  * Add Patrick Farrell to contributors\n  * Add Jason to contributors\n  * Add ZRHan to contributors\n  * Add Andrew Furman to contributors\n  * Add Andriy Senyshyn to contributors\n  * Add Bhagyashreek8 to contributors\n  * s3: add UCloud Object Storage provider (#9230)\n  * bisync: fix handling of unreadable lockfiles - fixes #9290\n  * librclone/ctest: add Windows support and fix memory management\n  * s3: fix regression where PutObject fails with non-seekable readers\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Add OVHcloud storage classes\n  * local: remove fadvise calls that cause spinlock contention\n  * Changelog updates from Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * webdav: request only required properties in listAll to improve performance\n  * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * copyurl: fix ignored --upload-headers and --download-headers\n  * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * Add Billy Hughes to contributors\n  * accounting: Add deletedDirs stat to core/stats help output\n  * docs: added text to the label showing version-introduced info\n  * Changelog updates from Version v1.73.2\n  * fs/log: fix data race on OutputHandler.format field\n  * build(deps): bump docker/build-push-action from 6 to 7\n  * build(deps): bump docker/setup-buildx-action from 3 to 4\n  * build(deps): bump docker/metadata-action from 5 to 6\n  * build(deps): bump docker/setup-qemu-action from 3 to 4\n  * build(deps): bump docker/login-action from 3 to 4\n  * bisync: update changelog\n  * bisync: auto-generate rc help docs\n  * bisync: add more structured info to rc output\n  * bisync: add missing rc params - fixes #7799\n  * operations: multithread copy: grab memory before making go routines\n  * b2: add server side copy real time accounting\n  * s3: add server side copy real time accounting\n  * azureblob: add server side copy real time accounting\n  * operations: add method to real time account server side copy\n  * Add Duncan F to contributors\n  * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency\n  * Add razorloves to contributors\n  * docs: fix new drive flag typo in changelog\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * Add Bjoern Franke to contributors\n  * Add Brian Bockelman to contributors\n  * Add Romāns Potašovs to contributors\n  * Add Adam Kasztenny to contributors\n  * Add hxnd to contributors\n  * Add Bjoern Franke to contributors\n  * Add FTCHD to contributors\n  * build(deps): bump actions/upload-artifact from 6 to 7\n  * build(deps): bump actions/download-artifact from 7 to 8\n  * serve http: add gzip compression\n  * webdav: permit redirects on PROPFIND for metadata\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * touch: add metadata when using `--metadata-set`\n  * s3: ionos: updated regions & endpoints\n  * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR\n  * drive: add integration test for handling folder names with single quotes\n  * http: dark mode for browser\n  * docs: note that --use-server-modtime only works on some backends\n  * Add a1pcm to contributors\n  * Add Leon Brocard to contributors\n  * Add Dark Dragon to contributors\n  * internxt: fix Entry doesn't belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * s3: add new Fastly Object Storage regions\n  * docs: Fix headers hierarchy for mount.md\n  * serve http: add fallback embedded favicon\n  * graphics: optimise images losslessly with ImageOptim\n  * docs: update sponsors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Chris to contributors\n  * Add Shlomi Avihou to contributors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Varun Chawla to contributors\n  * Add Prakhar Chhalotre to contributors\n  * s3: add Object Lock support\n  * webdav: escape reserved characters in URL path segments\n  * s3: add Zadara Object Storage provider\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * accounting: update String method output format for clarity in transfer rate representation - fixes #9129\n  * docs: add instructions on how to update Go version\n  * build: modernize Go code with go fix for go1.25\n  * build: update all dependencies\n  * lib/rest: remove go1.24 workaround now go1.25 is the minimum\n  * build: update to go1.26 and make go1.25 the minimum required version\n  * Add Jack Kelly to contributors\n  * Changelog updates from Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * test_all: increase retries for Internxt eventual consistency\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * Add kingston125 to contributors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * filelu: migrate API calls to lib/rest\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * Add Cohinem to contributors\n  * Add Leon Brocard to contributors\n  * s3: remove StackPath Object Storage provider\n  * drime: implement About\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * s3: add Fastly Object Storage provider\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * pikpak: support custom filenames for addurl backend command - fixes #9111\n  * Start v1.74.0-DEV development\n","affected":[{"package":{"name":"rclone","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/rclone&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"rclone":"1.74.4-bp160.1.1","rclone-bash-completion":"1.74.4-bp160.1.1","rclone-zsh-completion":"1.74.4-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21436-1.json"}}],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262438"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262439"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266210"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267192"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267869"},{"type":"REPORT","url":"https://bugzilla.suse.com/1271056"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-68121"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25680"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25681"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27136"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27141"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27145"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32952"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33809"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33813"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33814"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39824"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39827"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39828"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39829"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39830"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39831"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39832"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39833"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39834"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39835"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41176"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41179"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42500"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42502"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42504"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42506"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42507"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42508"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-44740"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46595"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46597"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46598"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-49980"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-54572"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59732"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-59733"}]}