CVE-2026-53786

A flaw was found in rsync. This vulnerability allows authenticated clients to bypass module-level filter restrictions. By supplying malicious merge file directives, an attacker can inject rules that override the daemon's intended file exclusion policies. This leads to information disclosure, as attackers can gain unauthorized access to files that should have been restricted.

This Moderate impact flaw in rsync allows an authenticated client to bypass module-level filter restrictions. An attacker with authenticated access to an rsync daemon configured with module filters could supply malicious merge file directives to access files intended to be excluded. This risk is present when rsync is used in daemon mode with active module-level filtering.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the rsync daemon to only trusted clients and networks. If module-level filtering is not essential for your deployment, consider reconfiguring rsync to operate without module filters or avoid running rsync in daemon mode.