| [CVE-2026-53783] rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory r | High(8.6) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53784] rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a compone | High(8.4) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53785] rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink compone | High(8.8) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53786] rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Att | Medium(6.9) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53788] rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names con | Medium(6.9) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53789] rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a craft | High(7.1) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53790] rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, includin | Critical(9.2) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53791] rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with | Critical(9.1) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53792] rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffe | High(7.1) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53793] rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroo | Critical(9.1) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53794] rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero- | Medium(6.9) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53795] rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-des | High(8.1) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53796] rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate | High(7) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53797] rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect fi | Medium(5.7) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53798] rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influenci | Medium(6.9) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53799] rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symli | High(7.2) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53800] rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers c | High(7.1) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53801] rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module | High(8.2) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53802] rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file | High(8.4) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
| [CVE-2026-53803] rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-bat | High(8.5) | InteressataDettagli (3)3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
Interessata · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
Corretta · Corretta: 3.5.0+ds1-0+deb13u1 nvd · rsync · debian · 13
|
