CVE-2026-53796: rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1Fixed in 3.5.1+ds1-2Fixed in 3.5.2+ds1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53796?
The severity of CVE-2026-53796 is medium with a score of 6.3.
What type of vulnerability is CVE-2026-53796?
CVE-2026-53796 is a race condition vulnerability related to time-of-check to time-of-use (TOCTOU) in rsync.
How do I fix CVE-2026-53796?
To fix CVE-2026-53796, upgrade rsync to version 3.5.0 or later.
What is the main risk associated with CVE-2026-53796?
The main risk associated with CVE-2026-53796 is that attackers can redirect file writes to unintended locations by exploiting the destination directory handling.
Which version of rsync is affected by CVE-2026-53796?
Rsync versions prior to 3.5.0 are affected by CVE-2026-53796.