CVE-2026-53786
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
Risk Assessment
The risk is the possibility of unauthorized access to files that should be excluded by module filters, potentially leading to data confidentiality breaches.
Recommendation
It is recommended to upgrade rsync to version 3.5.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.