CLSA-2026-1788959958
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1788959958.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788959958
- Upstream
- Published
- 2026-09-09T13:19:31Z
- Modified
- 2026-10-26T09:30:54Z
- Summary
- rsync: Fix of 3 CVEs
- Details
-
- CVE-2026-53784: daemon module-root chdir escape under
use chroot = nobecause change_dir() reached the module path with a plain chdir(), which followed a planted parent-component symlink and served files from outside the module; the module-root chdir now resolves through an ownership-checked O_NOFOLLOW path walk - CVE-2026-53802: arbitrary file read via symlinked operator-supplied input paths because --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/--exclude-from and the --password-file / daemon secrets file were opened by path, letting a planted symlink feed an arbitrary file to the filter parser or the authentication response; these now use the same ownership-checked path walk
- CVE-2026-53803: arbitrary file write via symlinked operator-supplied output paths because --log-file, --write-batch/--read-batch and the daemon motd, lock and --config opens resolved by path, letting a planted symlink redirect a privileged write; these now use the same ownership-checked path walk, and --read-batch additionally requires a regular file or a FIFO
- Note: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.
- CVE-2026-53784: daemon module-root chdir escape under
- References
Affected packages
TuxCare:CentOS-Stream:8 / rsync
Package
- Name
- rsync
- Purl
- pkg:rpm/tuxcare/rsync?distro=centos-stream-8