CVE-2026-53786

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description Authenticated clients can bypass module-level filter restrictions by providing malicious --filter merge file directives. During filter evaluation, attackers can inject client-side merge file directives to create rules that override the restrictions set by the daemon module, allowing unauthorized access to files that were intended to be excluded.

Recommendations Update rsync to version 3.5.0 or later.