Skip to content

GHSA-mrc3-6cwx-hch6 on CTRL-OS 26.05

Aliases: GHSA-mrc3-6cwx-hch6, CVE-2026-53786

Packages: rsync

Status: Plausible

Advisory Information

A client-supplied merge-file filter (--filter=._<path> via --remote-option) was checked against the module-prefixed absolute path, which never matches a daemon rule anchored at the module root, so a forbidden merge file was loaded and its rules applied on the server side.

Fix: strip the module-dir prefix before the daemon-filter check, matching the existing --exclude-from/--include-from handling.

Test: daemon-filter-merge-bypass.

Credit: Mitchell Benjamin (Revamp Studio).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”