CVE-2026-53783
Received Received - Intake

rsync TOCTOU Race Condition in rrsync Wrapper

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53783
EUVD
EUVD-2026-58090

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in rsync versions before 3.5.0, specifically in the rrsync restricted shell wrapper. It allows authenticated clients to bypass directory restrictions by replacing a symlink after validation but before file transfer. Attackers can also use unsafe flags like --copy-unsafe-links, -D, and --log-file to read or write files outside permitted directories.

Detection Guidance

Check rsync version with 'rsync --version' to confirm if it is 3.4.3 or earlier. Inspect rrsync wrapper scripts for unsafe flag usage like --copy-unsafe-links, -D, or --log-file. Monitor for unexpected file access outside restricted directories.

Impact Analysis

This vulnerability can allow attackers with authenticated access to escape restricted directories and access or modify files outside intended locations. It may lead to unauthorized data disclosure, modification, or system compromise depending on the rsync configuration and exposed files.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using vulnerable rsync versions risk data breaches that could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later. Disable rrsync restricted shell if not needed. Remove or restrict unsafe flags like --copy-unsafe-links and -D in rrsync configurations. Ensure log files are not symlinks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart