CVE-2026-53783

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description The rrsync restricted shell wrapper contains a time-of-check to time-of-use (TOCTOU) race condition. This occurs when a system checks a condition (such as a file path validation) and then uses the result of that check, but the condition changes between the check and the use. Authenticated clients can exploit this to bypass directory restrictions by replacing a path component with a symlink after the validation process but before the transfer is processed. Furthermore, attackers can use unrestricted flags including --copy-unsafe-links, -D, and --log-file via rrsync to read or write files outside the authorized directory subtree.

Recommendations Update rsync to version 3.5.0 or later.