Time-of-check Time-of-use (TOCTOU) Race Condition in Rsync - CVE-2026-53796

Vulnerability details

The vulnerability allows a local user to overwrite files outside the destination tree.

The vulnerability exists due to a time-of-check time-of-use race condition in the non-daemon receiver destination chdir handling when processing an operator-named destination directory. A local user can race the destination path from a directory to a symlink pointing outside the destination tree to overwrite files outside the destination tree.

This issue affects non-daemon receiver operation and can lead to local privilege escalation in scenarios such as privileged scheduled rsync runs over an attacker-controlled destination component.

Affected software

How to mitigate CVE-2026-53796

External References

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-w75h-ccff-w53m

Related Security Bulletins

• Multiple vulnerabilities in Rsync