Improper access control in Rsync - CVE-2026-53786
Published: August 13, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass file filtering restrictions and disclose sensitive information or modify data.
The vulnerability exists due to improper access control in the daemon filter check for client-supplied merge-file filters when processing a client-supplied merge-file filter via --remote-option. A remote attacker can supply a specially crafted merge-file filter path to bypass file filtering restrictions and disclose sensitive information or modify data.
The issue occurs because the merge-file filter was checked against a module-prefixed absolute path, causing daemon rules anchored at the module root to fail to match and allowing server-side merge-file rules from a forbidden file to be applied.