CVE-2026-53783

A time-of-check to time-of-use (TOCTOU) race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended boundary controls and read or write arbitrary files outside the designated directory.

An Important TOCTOU race condition in rsync's rrsync wrapper allows authenticated users to manipulate symlinks and escape directory boundaries, granting unauthorized read and write access to files outside the intended subtree.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use the rrsync SSH forced-command wrapper until patched packages are applied. If restricted rsync over SSH is strictly required, grant access only to SSH identities that are fully trusted with the host account's entire filesystem privileges, as rrsync cannot safely enforce directory boundaries. Note that standard rsync daemon firewall controls (TCP 873) do not mitigate this flaw, as execution occurs entirely over SSH (TCP 22).