Skip to content

GHSA-w75h-ccff-w53m on CTRL-OS 26.05

Aliases: GHSA-w75h-ccff-w53m, CVE-2026-53796

Packages: rsync

Status: Plausible

Advisory Information

The receiver's one-time chdir() into the operator-named destination directory was confined only for the daemon; a non-daemon receiver took a plain chdir() (an absolute dest was only partly probed, a relative dest not at all). A local attacker who races the named destination from a directory to a symlink->outside moves the receiver's working directory -- and every file it then creates -- OUTSIDE the destination tree. Canonical case: a root nightly rsync -a /src/ /dest/ over a tree with an attacker-controlled destination component (arbitrary write / local privilege escalation).

Fix: route the non-daemon destination chdir (absolute and relative) through the same ownership-checked O_NOFOLLOW walk used for the daemon module chdir; it still follows the operator's/root's own symlinked dest (the /backup -> /mnt/disk admin pattern) but refuses one owned by another uid. --insecure-links restores the legacy plain chdir.

Tests: symlink-race-dest, symlink-race-relative-dest (cross-uid; need root).

Credit: Omar Elsayed (seks99x).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”