CVE-2026-53784

Report

Executive Summary

CVE-2026-53784 is a path traversal vulnerability in rsync versions prior to 3.5.0. The flaw allows remote clients to read files outside the intended module root when the use chroot option is disabled and either the module root path or a component of it is a symlink. Successful exploitation enables unauthorized disclosure of arbitrary files readable by the rsync daemon process and potential modification of files, leading to data breaches and potential lateral movement within the affected environment. All organizations running rsync daemons with exposed writable or readable modules should prioritize upgrading to rsync 3.5.0.

Technical Analysis

The vulnerability resides in the rsync daemon's session initialization logic. When the daemon receives a connection, it changes its current working directory to the configured module root using the chdir() system call. Critically, the code path does not resolve symbolic links in the module root path using realpath() or an equivalent function. Therefore, if any component of the module root path is a symlink, the daemon's working directory becomes the symlink's target directory, not the intended module root.

This behavior is exploitable when the use chroot directive is disabled (the default in many configurations, or explicitly set by administrators for module flexibility). With chroot enabled, the daemon confines file operations to the module root; without it, the daemon relies solely on the working directory as the base for all path operations. Once the working directory is effectively the symlink target, subsequent relative path operations (e.g., fetching a file requested by a client using ../ traversal sequences) are executed relative to that new base directory.

As a result, a remote client can send requests with path traversal sequences (e.g., ../../etc/shadow) that escape the intended module root and access any file on the host filesystem that the rsync process has read permissions to. The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), indicating that the issue stems from following symlinks before verifying the containment of the resulting path. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a limited attack scope (local adjacency) with high confidentiality and integrity impact but no availability impact.

The attack surface includes any network-accessible rsync daemon instance with at least one module configured with use chroot = no and a module root path that contains a symlink. Common scenarios involve module roots located under /srv/, /home/, or custom data directories where symlinks are used for organizational convenience or to reference external storage mounts.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain can be inferred as follows:

1. Reconnaissance/Target Identification: An attacker scans for hosts exposing the rsync daemon service, typically on TCP port 873. Tools like nmap scripts or Shodan queries (e.g., port:873 'rsync') can identify potential targets. The attacker may also use rsync --list-only rsync://target/ to enumerate available modules and their configurations, looking for modules where chroot is likely disabled.

2. Triggering the Flaw: The attacker connects to the identified rsync module. The vulnerability triggers automatically at session initialization when the daemon calls chdir() to the module root without resolving symlinks. If the module root or any component contains a symlink, the daemon's base directory shifts to the symlink target.

3. Payload/Execution: At the vulnerability-class level, the attacker exploits the path traversal by sending file requests that include traversal sequences. For example, requesting a file path such as ../../../../etc/passwd after establishing the session. Since the daemon's working directory is no longer the intended module root, these relative paths resolve outside the intended containment. The rsync protocol allows clients to request file transfers by path; no specific function names or protocol endpoints are detailed in the available description.

4. Post-Exploitation Impact: Upon successful traversal, the attacker can read sensitive files (e.g., /etc/shadow, application credentials, private keys) from the host system, subject to the daemon's user permissions. With write access to any traversed directory where the daemon user has write permissions, the attacker could also upload malicious files (e.g., a web shell into a web root) enabling code execution and lateral movement.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class (path traversal with symlink confusion) as described. The lack of a PoC does not reduce the severity because the underlying mechanism is well understood.

Impact Assessment

The CVSS score of 7.1 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N highlights the following impacts:

• Confidentiality (High): Remote clients can read arbitrary files from the host system, potentially including system secrets, application data, and user data. This is the primary impact.
• Integrity (High): If the daemon has write access outside the module root, attackers can modify or upload files, potentially leading to backdoors or data corruption.
• Availability (None): The vulnerability does not directly cause denial of service.
• Attack Vector (Local): Although triggered by a remote client, the victim daemon operates on the local host, hence the local vector classification.
• Privileges Required (Low): The attacker only needs network access to the rsync module; no pre-existing authentication is required to trigger the vulnerable code path.

Affected systems are all deployments of rsync daemon versions before 3.5.0 where use chroot is disabled. Such configurations are common in environments where administrators require access to multiple filesystem locations via a single module or when symlinking is used to organize data. The blast radius is significant for internet-facing rsync daemons, as they may expose sensitive data or be used as a foothold for further compromise.

Detection Guidance

The following detection rules are crafted to identify exploitation attempts. They focus on anomalous path traversal patterns and unusual rsync protocol behavior.

Sigma Rule

title: Rsync Path Traversal Attempt via Symlink Confusion (CVE-2026-53784)
id: 5c1e9f2a-8b4d-4f6e-9a1c-3d8e1a7c2b5f
status: experimental
description: Detects rsync requests containing path traversal sequences that may indicate exploitation of CVE-2026-53784
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/rsync'
    CommandLine|contains:
      - 'rsync://'
      - '../'
  condition: selection
level: high
tags:
  - attack.t1210
  - cve.2026.53784

YARA Rule

rule CVE_2026_53784_Rsync_PathTraversal {
    meta:
        author = "valtersit.com"
        description = "Detects rsync daemon log entries or network payloads containing path traversal patterns"
        date = "2026-01-01"
        severity = "high"
    strings:
        $traversal = "../"
        $rsync_marker = "rsync:"
        $proto = "@ERROR: chdir failed"
    condition:
        ($traversal and $rsync_marker) or $proto
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET POLICY Rsync Path Traversal Attempt CVE-2026-53784"; flow:to_server,established; content:"|2e 2e 2f|"; depth:50; content:"rsync"; fast_pattern:only; classtype:attempted-user; sid:20260001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name == "rsync" and process.args == "rsync://"]
  [process where event.type == "start" and process.args : "*/../*"]

Splunk SPL Query

index=linux sourcetype=rsync
| regex _raw="\.\."
| stats count by src_ip, dest_ip, module, command
| where count > 10

Wazuh OSSEC Rule

<rule id="100537" level="12">
  <decoded>
    <program_name>rsync</program_name>
  </decoded>
  <description>Rsync path traversal attempt detected (CVE-2026-53784)</description>
  <match>\.\.</match>
  <group>rsync,path_traversal,t1210,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (NVD and OSV) confirm a fix is available in rsync 3.5.0.

1. Immediate Mitigations:

   • If immediate upgrade is not possible, enable use chroot = yes for all rsync modules. This confines file access to the module root, preventing path traversal outside it.
   • Remove symlinks from all rsync module root paths and ensure the root is a real directory.
   • Restrict network access to the rsync daemon, allowing connections only from trusted hosts or internal networks via firewall rules.

2. Patch/Upgrade Steps:

   • Upgrade rsync to version 3.5.0 or later on all affected servers. This is the definitive fix that resolves the symlink resolution issue.
   • After upgrade, thoroughly test all rsync modules to ensure functionality remains intact.

3. Long-Term Hardening:

   • Enable chroot by default for all rsync modules unless a specific business requirement necessitates disabling it.
   • Regularly audit rsync module configurations for unsafe settings (e.g., use chroot = no) and symlinked paths.
   • Implement file integrity monitoring and security logging for the rsync daemon.
   • Monitor internet-facing rsync services with the detection rules provided above.

References

1. NVD Entry for CVE-2026-53784: https://nvd.nist.gov/vuln/detail/CVE-2026-53784
2. OSV Database reference for CVE-2026-53784 (patch confirmation): https://ossf.github.io/osv-schema/
3. Samba Project (rsync is historically maintained under the Samba umbrella): https://www.samba.org/rsync/
4. MITRE ATT&CK Technique T1210 - Exploitation of Remote Services: https://attack.mitre.org/techniques/T1210/
5. CWE-59 - Improper Link Resolution Before File Access: https://cwe.mitre.org/data/definitions/59.html

No known threat actor campaigns or exploit-in-the-wild evidence was available at the time of writing. The CVE is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.