TOCTOU Race Condition in Rsync Affects Directory Handling

CVE-2026-53796

What is CVE-2026-53796?

Rsync prior to version 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in its non-daemon receiver's handling of destination directories. This vulnerability allows an attacker who can manipulate components of the destination path to redirect file writes to unintended locations. By substituting a symbolic link for a component of the destination path between the path resolution and the chdir() call, the attack can change the receiver's working directory to a location outside of the intended destination tree. As a result, subsequent file writes using relative paths may land in unintended areas of the filesystem, potentially leading to unauthorized file access or loss of data integrity.

References