Skip to content

GHSA-fxwg-7hmf-xh5q on CTRL-OS 26.05

Aliases: GHSA-fxwg-7hmf-xh5q, CVE-2026-53789

Packages: rsync

Status: Plausible

Advisory Information

With rsync -rR --delete <host>/m/dir/file dest/, a malicious daemon-sender that omits the "no content dir" transmit flag on the implied parent dir makes the receiver treat it as a content directory and run delete_in_dir on it under --delete, sweeping pre-existing sibling files the client meant to keep.

Additional variants (same root cause — a peer reclassifying a transfer-root / implied-parent flist entry to widen destructive scope):

  • Synthetic transfer-root as a content directory. The receiver exempts the synthetic . transfer-root entry from its requested-name filter. A malicious sender can send . with XMIT_TOP_DIR (no XMIT_NO_CONTENT_DIR), making the receiver run delete_in_dir(".") over the entire destination root under --delete, deleting receiver-owned files well outside the requested leaf.
  • Legacy (protocol < 30) branch. The original implied-parent downgrade did not cover the pre-30 code path, so the same reclassification still widened --delete there.
  • Synthetic transfer-root as a non-directory (--force destination wipe). The same exempt . entry can be forged as a regular file. When the receiver finds a directory where the peer's entry says a file should be, --force (or --delete) calls delete_item(dest_root, DEL_RECURSE) — recursively erasing the entire destination directory before creating the phantom file. On a writable daemon module this also bypasses refuse options = delete, since the deletion runs via --force, not --delete.

Fix (receiver-side): downgrade implied-parent directories — including the synthetic . transfer root and the legacy pre-30 branch — to non-content regardless of the sender's flags, so deletion cannot run on a directory the client only named as a parent; and reject a non-directory transfer-root entry outright, so a forged .-as-file cannot drive a --force recursive delete of the destination.

Tests: malicious-sender-delete-scope, malicious-dot-dir-delete-scope, peer-legacy-implied-delete-scope, malicious-dot-file-delete-scope, daemon-dot-file-force-wipe.

Credit: Mitchell Benjamin (Revamp Studio); Filipe Casal of Trail of Bits in collaboration with OpenAI — synthetic-root, legacy-branch, and non-directory-root variants.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”