CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

CVE-2026-53789

CVE-2026-53789 affects rsync prior to 3.5.0 and describes an improper path handling vulnerability that lets a malicious sender expand the scope of --delete operations to delete files outside the intended destination subtree. The attack is carried out by a crafted file list that can cause rsync to...

CVE-2026-53789

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

EUVD-2026-58097

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

CVE-2026-49820 Probo has an open redirect bypass via path normalization

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...

CVE-2026-49820 Probo has an open redirect bypass via path normalization

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...

CVE-2026-49820

Probo (go.probo.inc/probo) carries a path normalization bug in its saferedirect redirect validator. Before patch 0.193.1, the validator only inspected the second character of relative paths, allowing crafted URLs like /../\evil.com to pass validation; Go's http.Redirect then normalizes the path t...

CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

EUVD-2026-58092

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

CVE-2026-53785

CVE-2026-53785 affects rsync prior to 3.5.0. The vulnerability is a path traversal in --relative mode where make_path() follows symlinks outside the destination tree while creating intermediate directories, enabling an attacker to write files outside the intended destination on the receiver’s fil...

CVE-2026-53785

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-53784

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

EUVD-2026-58091

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...

CVE-2026-53784

CVE-2026-53784 affects rsync before 3.5.0. A path traversal vulnerability arises when use of chroot is disabled and the module root path (or a component) is a symlink. At session init, rsync calls chdir() to the module root without resolving symlinks (realpath or equivalent), causing subsequent r...

CVE-2026-53783

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...