Improper access control in Rsync - CVE-2026-53786

 

Improper access control in Rsync - CVE-2026-53786

Published: August 13, 2026


Vulnerability identifier: #VU142293
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53786
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass file filtering restrictions and disclose sensitive information or modify data.

The vulnerability exists due to improper access control in the daemon filter check for client-supplied merge-file filters when processing a client-supplied merge-file filter via --remote-option. A remote attacker can supply a specially crafted merge-file filter path to bypass file filtering restrictions and disclose sensitive information or modify data.

The issue occurs because the merge-file filter was checked against a module-prefixed absolute path, causing daemon rules anchored at the module root to fail to match and allowing server-side merge-file rules from a forbidden file to be applied.


Affected software

Rsync

How to mitigate CVE-2026-53786

Install security update from vendor's website.

Rsync - update to 3.5.0

External References

Related Security Bulletins