Path Confinement Bypass in rsync Affects Remote Clients

CVE-2026-53793

What is CVE-2026-53793?

Rsync, a widely used file transfer program, suffers from a significant path confinement bypass vulnerability in versions prior to 3.5.0. This vulnerability allows remote clients to escape the designated inner-module root confinement. By manipulating paths employing the /./ notation, attackers can bypass security measures intended to protect sensitive files. Specifically, they can forge delta-basis transfers referencing xname paths that interact with the /./ boundary marker, potentially gaining unauthorized read or write access to files located outside the boundaries set by the chroot environment. Users are strongly advised to upgrade to the latest version to mitigate this risk.

References