CVE-2026-53784

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A path traversal issue exists when the use chroot setting is disabled and the module root path, or any of its components, is a symbolic link (a file that points to another file or directory). During session initialization, the daemon uses the chdir() function to enter the module root without resolving symbolic links through realpath() or a similar method. This causes relative-path operations to reference files based on the symbolic link target instead of the intended module root, allowing remote clients to access files outside the designated directory.

Recommendations Update rsync to version 3.5.0 or later.