High severity8.1NVD Advisory· Published Aug 13, 2026· Updated Nov 6, 2026
CVE-2026-53783
CVE-2026-53783
Description
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords5 versionspkg:rpm/almalinux/rsyncpkg:rpm/almalinux/rsync-daemonpkg:rpm/almalinux/rsync-rrsyncpkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweed
< 3.2.7-1.el9_8+ 4 more
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.4.1-160000.6.1
- (no CPE)range: < 3.5.1-1.1
Patches
Vulnerability mechanics
References
3- github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5nvdVendor Advisory
- www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsyncnvdThird Party Advisory
- github.com/RsyncProject/rsync/releases/tag/v3.5.0nvdRelease Notes
News mentions
0No linked articles in our index yet.