CVE-2026-53785 is a path traversal vulnerability in rsync before version 3.5.0. A malicious sender can write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the [truncated]
The CVE-2026-53784 vulnerability affects rsync, a widely-used file synchronization tool. The vulnerability class is path traversal, which allows remote clients to access files outside the intended module root when chroot is disabled and the module root path or a component of it is a symlink. The likely operational impact is unauthorized file access. Source-confidence limits are based on official CVE and N [truncated]
CVE-2026-53783 is a high-severity vulnerability in rsync that allows authenticated clients to escape directory restrictions through a time-of-check to time-of-use (TOCTOU) race condition in the rrsync restricted shell wrapper. This could lead to unauthorized access and data manipulation. Defenders should assess exposure, prioritize verification and remediation efforts, and implement compensating controls [truncated]
CVE-2026-29518 affects rsync versions before 3.4.3. The issue is a time-of-check to time-of-use race in daemon file handling that can let an attacker redirect writes outside the intended directory by swapping parent path components with symbolic links. In the conditions described, an attacker with write access to a module path could create or overwrite arbitrary files, which may lead to sensitive file mod [truncated]
CVE-2026-43618 affects Rsync 3.4.2 and prior. A signed 32-bit counter in the compressed-token decoder is not checked for overflow, which can let a malicious sender cause the receiver to read and return data outside the intended buffer. The practical impact is information disclosure from process memory, including secrets and memory pointers that can weaken ASLR.
CVE-2026-43617 is an authorization bypass in rsync daemon deployments that rely on hostname-based access controls while running in chroot. Published on 2026-05-20, the issue affects rsync 3.4.2 and prior. The bug can let a remote attacker influence reverse DNS results for their source IP and bypass hostname-based deny rules that were expected to block the connection. The vendor advisory and release notes [truncated]
