Link following in Rsync - CVE-2026-53793
Published: August 13, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and modify files outside the intended inner module.
The vulnerability exists due to improper link resolution before file access in rsync inner-module path handling when processing a chrooted \"/./\" inner module with a parent-component symlink or a peer-forged delta-basis path. A remote attacker can supply crafted path components to access files outside the inner module to disclose sensitive information and modify files outside the intended inner module.
The issue occurs when use chroot = yes is enabled with a \"/./\" inner module, and it also affects peer-controlled delta-basis names during client pull operations with --link-dest, --copy-dest, --compare-dest, or --fuzzy.