https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:40:31 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-53786 <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-53786 https://cve.radiocsirt.org/vuln/euvd-2026-352925 EUVD-2026-352925 https://cve.radiocsirt.org/vuln/euvd-2026-352925 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53786 <p>rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.</p> <p>rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53786 https://cve.radiocsirt.org/vuln/msrc_cve-2026-53786 msrc_CVE-2026-53786 https://cve.radiocsirt.org/vuln/msrc_cve-2026-53786 https://cve.radiocsirt.org/vuln/oesa-2026-3949 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: rsync</p> <p>Rsync is an open source utility that provides fast incremental file transfer. It uses the &amp;amp;quot;rsync algorithm&amp;amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):</p> <p>Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with &amp;apos;use chroot = no&amp;apos;.(CVE-2026-43619)</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: rsync</p> <p>Rsync is an open source utility that provides fast incremental file transfer. It uses the &amp;amp;quot;rsync algorithm&amp;amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):</p> <p>Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with &amp;apos;use chroot = no&amp;apos;.(CVE-2026-43619)</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3949 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 <p>rsync-3.5.1-1.1 on GA media</p> <p>rsync-3.5.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 <p>Security update for rsync</p> <p>Security update for rsync</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-53786 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync</p> <p>rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync</p> <p>rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-53786 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817 <p>Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817