CVE-2026-53784

HighCVSS 7.1/10Last modified Oct 24, 2026

Description

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-59

Affected software

VendorProductVersions
RsyncProjectrsync<= 3.4.4

References

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-537857.1rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination diCVE-2026-537866.5rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictionCVE-2026-537879.8Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unautCVE-2026-537886.5rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers toCVE-2026-537898.1rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operationCVE-2026-53793.0An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. ThCVE-2026-537908.1rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by suCVE-2026-537919.1rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based acceCVE-2026-537926.5rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to CVE-2026-537937.4rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confCVE-2026-537945.3rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allCVE-2026-537958.1rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree
CVE-2026-53784: High severity, CVSS 7.1 | Vulnix