CVE-2026-53796

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A time-of-check to time-of-use (TOCTOU) race condition exists in the non-daemon receiver's destination directory handling. This occurs when an attacker manipulates parent components of the destination path by substituting a symlink between the path resolution and the chdir() function call. This action causes the receiver's working directory to be established outside the intended destination tree, allowing subsequent relative-path file writes to be redirected to unintended filesystem locations.

Recommendations Update rsync to version 3.5.0 or later.