Threats Tagged 'cve-2026-53796'

A security update for rsync addresses multiple vulnerabilities including directory escape issues, command injection, symlink races, denial of service, privilege escalation, and unauthorized file access. These vulnerabilities affect various rsync daemon and sender/receiver functionalities, potentially allowing attackers to bypass restrictions, execute arbitrary commands, cause crashes, or manipulate files outside intended directories. The update fixes a broad set of issues identified by CVE identifiers ranging from CVE-2026-53783 to CVE-2026-70464.

A time-of-check to time-of-use (TOCTOU) race condition exists in rsync before version 3.5.0 in the non-daemon receiver's handling of the destination directory. This vulnerability allows an attacker who can manipulate the destination path's parent components to redirect file writes to unintended locations by substituting a symlink between path resolution and the directory change operation. This causes the working directory to be set outside the intended destination tree, potentially leading to unauthorized file writes.

Rsync ist ein Tool, um Dateien und Verzeichnisse zu synchronisieren.