CVE-2026-53793
Received Received - Intake

rsync Path Confinement Bypass Before 3.5.0

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53793
EUVD
EUVD-2026-58101

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
rsync rsync to 3.5.0 (exc)
rsync rsync 3.4.3
rsync rsync 3.4.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects rsync versions before 3.5.0. It allows remote attackers to bypass the chroot confinement by exploiting improper handling of the /./ notation in module paths. Attackers can construct crafted paths or forge delta-basis transfers to access files outside the intended module subtree, leading to unauthorized read or write access.

Detection Guidance

Check rsync version with 'rsync --version' to see if it is 3.4.3 or earlier. Inspect rsync configuration files for modules using '/./' in paths. Monitor network traffic for unusual file access patterns or requests involving '/./' in module paths.

Impact Analysis

An attacker could exploit this to read or write files outside the rsync module's directory, potentially accessing sensitive data or modifying files. This includes scenarios where a malicious server supplies a traversal-based basis name to disclose file contents, especially when using options like --link-dest or --copy-dest.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal consequences due to unauthorized exposure or modification of protected health or personal information.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable rsync modules using '/./' in paths until patched. Review and restrict access to rsync services, especially those exposed to untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart