rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory… (CVE-2026-53796)

rsync before version 3.5.0 contains a TOCTOU race condition vulnerability in the handling of the destination directory by the non-daemon receiver. An attacker capable of manipulating the parent components of the destination path can substitute a symbolic link between the time the path is checked and the time the process changes directory (chdir()). This causes the receiver's working directory to be established outside the intended destination tree, resulting in subsequent relative-path file writes being redirected to unintended filesystem locations.

The vulnerability allows an attacker with the ability to manipulate destination path parent components to redirect file writes to arbitrary locations on the filesystem. This can lead to unauthorized modification of files outside the intended destination directory, potentially impacting system integrity and availability. The CVSS vector indicates local attack vector with high attack complexity and low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects rsync versions before 3.5.0, upgrading to version 3.5.0 or later is recommended once an official fix is available. Until then, restrict access to rsync destination paths to trusted users to prevent manipulation of destination path components.