Path Traversal Vulnerability in rsync Affects Remote File Access

CVE-2026-53784

What is CVE-2026-53784?

A security flaw in rsync prior to version 3.5.0 allows remote clients to manipulate the filesystem by accessing files outside the designated module root. This occurs when chroot is disabled, and the module root path includes a symlink. During session initialization, the daemon uses chdir() without resolving symlinks, leading relative path operations to be incorrectly referenced to the symlink target rather than the actual module root. This oversight can result in unauthorized access to sensitive files, posing a significant risk to system integrity.

References