CVE-2026-53784: rsync < 3.5.0 Path Traversal via Symlink Module Root
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Compensating control
If using rsync < 3.5.0 and use of chroot is disabled, ensure the module root path and no component of it is a symlink to prevent remote clients from accessing files outside the intended module root.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53784?
The severity of CVE-2026-53784 is classified as high with a score of 7.1.
How do I fix CVE-2026-53784?
To fix CVE-2026-53784, upgrade Rsync to version 3.5.0 or later to mitigate the path traversal vulnerability.
What systems are affected by CVE-2026-53784?
CVE-2026-53784 affects Rsync versions before 3.5.0 where chroot is disabled and the module root path contains a symlink.
What type of attack does CVE-2026-53784 enable?
CVE-2026-53784 enables a path traversal attack, allowing remote clients to access unauthorized files outside the intended module root.
Is chroot security enough to prevent CVE-2026-53784?
No, chroot security is not enough to prevent CVE-2026-53784 if the module root path is a symlink and chroot is disabled.