Time-of-Check to Time-of-Use Race Condition in Rsync by Rsync Project

CVE-2026-53783

What is CVE-2026-53783?

A vulnerability exists in rsync before version 3.5.0 due to a time-of-check to time-of-use (TOCTOU) race condition in the rrsync restricted shell wrapper. This flaw enables authenticated clients to exploit symlink substitutions during the transfer process, allowing them to circumvent enforced directory restrictions. Attackers can leverage additional unrestricted flags, such as --copy-unsafe-links, -D, and --log-file, granting them the ability to read or write files beyond the originally permitted directory subtree.

References