CVE-2026-53783: rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsync (rrsync restricted shell wrapper)to a version that resolves this vulnerability.Fixed in 3.5.0 - Compensating control
Use a rsync version at least 3.5.0 to prevent TOCTOU race condition directory escape via the rrsync restricted shell wrapper.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53783?
The severity of CVE-2026-53783 is rated high at 8.1.
How do I fix CVE-2026-53783?
To fix CVE-2026-53783, upgrade rsync to version 3.5.0 or later.
What software is affected by CVE-2026-53783?
CVE-2026-53783 affects rsync versions prior to 3.5.0.
What type of vulnerability is CVE-2026-53783?
CVE-2026-53783 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability.
What can attackers do with CVE-2026-53783?
Attackers can escape enforced directory restrictions by exploiting the race condition in rrsync.