CVE-2026-53793 is a critical vulnerability in rsync prior to version 3.5.0 involving improper link resolution before file access (CWE-59). The vulnerability arises when the module root contains a /./ boundary marker, which rsync mishandles, allowing remote clients to bypass the intended chroot confinement. By exploiting this, attackers can construct paths or forge delta-basis transfers referencing paths that resolve outside the module's subtree, leading to unauthorized file read or write operations outside the confined directory.

Exploitation of this vulnerability can lead to unauthorized access to files outside the intended module root directory, potentially exposing sensitive data or allowing unauthorized modification of files. The CVSS 4.0 score of 9.1 indicates a critical severity with network attack vector, high complexity, and partial attack prerequisites, emphasizing the risk of remote exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the RsyncProject's advisories for updates and avoid using affected versions (<=3.4.4) in sensitive environments until a fix is available.