CVE-2026-53793

HighCVSS 7.4/10Last modified Oct 24, 2026

Description

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-537945.3rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allCVE-2026-537958.1rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination treeCVE-2026-537966.3rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination diCVE-2026-537974.7rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manCVE-2026-537985.3rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackersCVE-2026-537996.3rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extCVE-2026-53805.3An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. TCVE-2026-538004.7rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink cCVE-2026-538015.9rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause tCVE-2026-538027.1rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process CVE-2026-538037.8rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink CVE-2026-538047.2OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators
CVE-2026-53793: High severity, CVSS 7.4 | Vulnix