A critical authentication bypass vulnerability exists in rsync daemon versions up to 3.4.4. This flaw allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address. Exploiting this vulnerability enables attackers who can connect to the rsync daemon to circumvent host allow/deny rules and gain unauthorized access that would normally be blocked based on their real source IP.
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
CVE-2026-53789 is a vulnerability in rsync before version 3.5.0 that involves improper path handling. It allows a malicious sender to manipulate the --delete operation to delete files outside the intended destination directory by sending a crafted file list. This can occur through multiple variants including implied parent directory reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling.
A vulnerability in rsync before version 3.5.0 allows local attackers to inject newline characters into user or group names used in the uid/gid mapping interface. This newline injection can cause the rsync daemon to misinterpret protocol messages, potentially corrupting the uid/gid mapping logic. The issue is classified as CWE-93 (Improper Neutralization of CRLF Sequences).
CVE-2026-53786 is a medium severity vulnerability in rsync before version 3.5.0. It allows authenticated clients to bypass module-level filter restrictions by injecting malicious --filter merge file directives. This enables attackers to override intended file access restrictions and gain access to files that should be excluded by the module filter.
A path traversal vulnerability (CWE-59) exists in rsync versions up to 3.4.4. This flaw allows a malicious sender to write files outside the intended destination directory by exploiting symlink resolution in --relative mode. The vulnerability arises because the make_path() function follows symlinks without verifying that the resulting paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
CVE-2026-53784 is a path traversal vulnerability in rsync versions up to 3.4.4. When the rsync daemon is configured with use chroot disabled and the module root or a component of it is a symbolic link, remote clients can access files outside the intended module root. This occurs because the daemon changes directory to the module root without resolving symlinks, causing relative path operations to reference unintended locations.
A symlink race condition vulnerability exists in rsync versions up to 3.4.4. This flaw allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths by replacing a directory component with a symlink during traversal. This can lead to disclosure of file contents outside the intended transfer root.
A time-of-check to time-of-use (TOCTOU) race condition exists in rsync before version 3.5.0 in the non-daemon receiver's handling of the destination directory. This vulnerability allows an attacker who can manipulate the destination path's parent components to redirect file writes to unintended locations by substituting a symlink between path resolution and the directory change operation. This causes the working directory to be set outside the intended destination tree, potentially leading to unauthorized file writes.
CVE-2026-53795 is a high-severity vulnerability in rsync versions up to 3.4.4 that allows arbitrary file write outside the intended destination directory. This occurs due to improper link resolution when using the --temp-dir or --link-dest options, enabling attackers to bypass rename-confinement logic and write files to arbitrary locations accessible by the rsync process.
A logic error in rsync versions up to 3.4.4 in the handling of the --max-alloc option allows disabling allocation sanity checks. This can cause the receiver to attempt unbounded memory allocations, potentially leading to denial of service due to memory exhaustion.
CVE-2026-53793 is a critical vulnerability in rsync versions up to 3.4.4 that allows remote clients to bypass path confinement. By exploiting improper handling of the /./ boundary marker in module roots, attackers can access files outside the intended directory subtree, potentially gaining unauthorized read or write access.
CVE-2026-53792 is a high-severity vulnerability in rsync before version 3.5.0. It involves an out-of-bounds read on the sender side triggered by a malicious receiver sending a crafted checksum block with zero length. This causes a negative offset calculation during delta computation, leading to memory access before the start of an allocated buffer.
CVE-2026-53783 is a high-severity vulnerability in rsync versions up to 3.4.4. It involves a time-of-check to time-of-use (TOCTOU) race condition in the rrsync restricted shell wrapper, allowing authenticated clients to bypass directory restrictions by substituting symlinks after validation. Attackers can exploit certain unrestricted flags to read or write files outside the allowed directory subtree.
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.