rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
CVE-2026-53789 is a vulnerability in rsync before version 3.5.0 that involves improper path handling. It allows a malicious sender to manipulate the --delete operation to delete files outside the intended destination directory by sending a crafted file list. This can occur through multiple variants including implied parent directory reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling.
A vulnerability in rsync before version 3.5.0 allows local attackers to inject newline characters into user or group names used in the uid/gid mapping interface. This newline injection can cause the rsync daemon to misinterpret protocol messages, potentially corrupting the uid/gid mapping logic. The issue is classified as CWE-93 (Improper Neutralization of CRLF Sequences).
CVE-2026-53786 is a medium severity vulnerability in rsync before version 3.5.0. It allows authenticated clients to bypass module-level filter restrictions by injecting malicious --filter merge file directives. This enables attackers to override intended file access restrictions and gain access to files that should be excluded by the module filter.
A path traversal vulnerability (CWE-59) exists in rsync versions up to 3.4.4. This flaw allows a malicious sender to write files outside the intended destination directory by exploiting symlink resolution in --relative mode. The vulnerability arises because the make_path() function follows symlinks without verifying that the resulting paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
CVE-2026-53784 is a path traversal vulnerability in rsync versions up to 3.4.4. When the rsync daemon is configured with use chroot disabled and the module root or a component of it is a symbolic link, remote clients can access files outside the intended module root. This occurs because the daemon changes directory to the module root without resolving symlinks, causing relative path operations to reference unintended locations.
A symlink race condition vulnerability exists in rsync versions up to 3.4.4. This flaw allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths by replacing a directory component with a symlink during traversal. This can lead to disclosure of file contents outside the intended transfer root.
A time-of-check to time-of-use (TOCTOU) race condition exists in rsync before version 3.5.0 in the non-daemon receiver's handling of the destination directory. This vulnerability allows an attacker who can manipulate the destination path's parent components to redirect file writes to unintended locations by substituting a symlink between path resolution and the directory change operation. This causes the working directory to be set outside the intended destination tree, potentially leading to unauthorized file writes.
CVE-2026-53795 is a high-severity vulnerability in rsync versions up to 3.4.4 that allows arbitrary file write outside the intended destination directory. This occurs due to improper link resolution when using the --temp-dir or --link-dest options, enabling attackers to bypass rename-confinement logic and write files to arbitrary locations accessible by the rsync process.
A logic error in rsync versions up to 3.4.4 in the handling of the --max-alloc option allows disabling allocation sanity checks. This can cause the receiver to attempt unbounded memory allocations, potentially leading to denial of service due to memory exhaustion.
CVE-2026-53793 is a critical vulnerability in rsync versions up to 3.4.4 that allows remote clients to bypass path confinement. By exploiting improper handling of the /./ boundary marker in module roots, attackers can access files outside the intended directory subtree, potentially gaining unauthorized read or write access.
CVE-2026-53792 is a high-severity vulnerability in rsync before version 3.5.0. It involves an out-of-bounds read on the sender side triggered by a malicious receiver sending a crafted checksum block with zero length. This causes a negative offset calculation during delta computation, leading to memory access before the start of an allocated buffer.
CVE-2026-53783 is a high-severity vulnerability in rsync versions up to 3.4.4. It involves a time-of-check to time-of-use (TOCTOU) race condition in the rrsync restricted shell wrapper, allowing authenticated clients to bypass directory restrictions by substituting symlinks after validation. Attackers can exploit certain unrestricted flags to read or write files outside the allowed directory subtree.
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.(CVE-2026-53789)
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.(CVE-2026-53790)
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.