CVE-2026-53796 describes a TOCTOU race condition in rsync before version 3.5.0. The vulnerability occurs in the non-daemon receiver's destination directory handling, where an attacker able to manipulate parent components of the destination path can replace a path component with a symbolic link between path resolution and the chdir() system call. This causes the working directory to be set outside the intended destination tree, resulting in subsequent relative-path file writes landing in unintended filesystem locations.

An attacker with the ability to manipulate the destination path parent components can redirect file writes to arbitrary locations on the filesystem. This could potentially lead to unauthorized file overwrites or placement of malicious files outside the intended directory, impacting system integrity. The CVSS 4.0 score is 5.8 (medium severity), reflecting the local attack vector, high attack complexity, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Until a patch is available, users should restrict access to the rsync destination path and its parent directories to trusted users only to prevent manipulation of path components. Monitor vendor communications for updates on fixes.