CVE-2026-53786

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-537879.8Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unautCVE-2026-537886.5rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers toCVE-2026-537898.1rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operationCVE-2026-53793.0An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. ThCVE-2026-537908.1rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by suCVE-2026-537919.1rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based acceCVE-2026-537926.5rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to CVE-2026-537937.4rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confCVE-2026-537945.3rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allCVE-2026-537958.1rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination treeCVE-2026-537966.3rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination diCVE-2026-537974.7rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can man
CVE-2026-53786: Medium severity, CVSS 6.5 | Vulnix