The widely used synchronisation and backup tool rsync was released as version 3.5 on 13 August 2026 – an extraordinary update that fixes 33 security vulnerabilities at once. Anyone who uses rsync, especially as a daemon, should update promptly.
The critical flaw
Rated critical is CVE-2026-53791: it affects rsync daemons configured with proxy protocol = true. A client connecting directly instead of through the expected trusted proxy could send its own PROXY header and thereby spoof its source IP address.
Symlinks and path confinement
A large share of the remaining – partly high-severity – fixes concerns the handling of symbolic links and confinement to permitted paths. Several of these flaws could have allowed attackers to redirect rsync operations outside the intended directories.
In addition, control characters in filenames are now escaped before being written to the log, preventing terminal and log injection. And rsync-ssl now properly verifies the certificate and hostname when using stunnel. The fixes came from a focused audit of path handling and the daemon protocol, an accompanying fuzzing pass, and reports from external researchers.
