CVE-2026-53796 is a TOCTOU race condition vulnerability in rsync versions before 3.5.0 affecting the non-daemon receiver's destination directory handling. An attacker able to manipulate components of the destination path can replace a path component with a symbolic link after the path is checked but before the directory change (chdir()) call. This results in the receiver's working directory being established outside the intended destination directory tree, causing subsequent relative-path file writes to be redirected to unintended filesystem locations. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).

An attacker with the ability to influence the destination path parent components can cause rsync to write files outside the intended directory tree. This could lead to unauthorized file modification or overwriting in arbitrary filesystem locations accessible to the rsync process, potentially impacting system integrity or security depending on the context of use.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running vulnerable versions of rsync in environments where untrusted users can influence destination path components. Monitor vendor channels for updates regarding patches or official mitigations.