rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement… (CVE-2026-53793)

rsync versions prior to 3.5.0 contain a path confinement bypass vulnerability (CVE-2026-53793) that allows remote clients to circumvent the intended inner-module root confinement. This occurs when the module root path contains a /./ boundary marker, which rsync improperly handles. Attackers can exploit this by constructing paths that resolve outside the chroot boundary or by forging delta-basis transfers referencing xname paths crossing the /./ boundary. This results in unauthorized read or write access to files outside the module's subtree, violating intended access restrictions.

Successful exploitation allows remote attackers to escape the intended directory confinement, leading to unauthorized read and write access to files outside the designated module subtree. This can compromise data confidentiality and integrity on affected systems.

A fix is available in rsync version 3.5.0 and later. Users should upgrade to version 3.5.0 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise, so patching is recommended.