CVE-2026-53783

Summary

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as –copy-unsafe-links, -D, and –log-file through rrsync to read or write files outside the permitted directory subtree.

Affected Software

Weaknesses

• CWE-59: CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-88: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

References

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
• https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync

• ←Previous
• Next→