CVE-2026-53793

High [CVE-2026-53793] rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

CVE-2026-53793Source published Aug 13, 2026Source updated Aug 13, 2026

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree. A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access to files…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7

3 more entries in the full advisory.

Source-reported affected versions

• < 3.5.0

Source-reported fixed versions

• 3.5.0
• rsync-0:3.5.0-3.el10_2
• rsync-0:3.2.7-1.el9_8
• RHSA-2026:67463

1 more entries in the full advisory.

Mitigation guidance

• To mitigate this issue, avoid configuring rsync modules with a /./ boundary marker in their root path when operating in chroot mode. Review existing rsync configurations to ensure that module root paths do not contain /./ when chroot is enabled. If chroot mode is not strictly required for a given rsync module, consider disabling it. If changes are made to the rsync configuration, a restart of the rsync service may be required for the changes to take effect.