CVE-2026-53783

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5
https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) rsync anterior a la versión 3.5.0 contiene una vulnerabilidad de condición de carrera de tiempo de verificación a tiempo de uso (TOCTOU) en el envoltorio de shell restringido rrsync que permite a clientes autenticados evadir las restricciones de directorio impuestas al sustituir un enlace simbólico por un componente de ruta después de la validación pero antes del procesamiento de la transferencia. Los atacantes pueden aprovechar adicionalmente opciones no restringidas como --copy-unsafe-links, -D y --log-file a través de rrsync para leer o escribir archivos fuera del subárbol de directorio permitido.

Information

Published : 2026-08-13 15:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-53783

Mitre link : CVE-2026-53783

CVE.ORG link : CVE-2026-53783

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-53783", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53783", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T15:41:11.374187Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RsyncProject/rsync", "vendor": "RsyncProject", "product": "rsync", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.4"}, {"status": "unaffected", "version": "3.5.0", "versionType": "semver"}], "packageURL": "pkg:github/RsyncProject/rsync", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T15:19:41.913", "references": [{"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "rsync before\u00a03.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree."}, {"lang": "es", "value": "rsync anterior a la versi\u00f3n 3.5.0 contiene una vulnerabilidad de condici\u00f3n de carrera de tiempo de verificaci\u00f3n a tiempo de uso (TOCTOU) en el envoltorio de shell restringido rrsync que permite a clientes autenticados evadir las restricciones de directorio impuestas al sustituir un enlace simb\u00f3lico por un componente de ruta despu\u00e9s de la validaci\u00f3n pero antes del procesamiento de la transferencia. Los atacantes pueden aprovechar adicionalmente opciones no restringidas como --copy-unsafe-links, -D y --log-file a trav\u00e9s de rrsync para leer o escribir archivos fuera del sub\u00e1rbol de directorio permitido."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}