CVE-2026-53783 rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
Authenticated attackers can exploit a race condition in rrsync to bypass directory restrictions and read or write files outside the permitted subtree.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53783?
CVE-2026-53783 is a high-severity vulnerability in RsyncProject rsync, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.
Which versions are affected by CVE-2026-53783?
How do I fix CVE-2026-53783?
Upgrade to a fixed version.
Is CVE-2026-53783 being exploited?
There is no known exploitation of CVE-2026-53783 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-53783, AZL-95825, BELL-CVE-2026-53783, CLSA-2026-1791480690, CLSA-2026-1792576195, CLSA-2026-1792659934 and 5 more.