{"id":"CLSA-2026-1788951664","summary":"rsync: Fix of 6 CVEs","details":"- CVE-2026-53784: refuse attacker-planted symlinks when a daemon module\n  resolves its absolute path with \"use chroot = no\"\n- CVE-2026-53786: strip the module-dir prefix before checking a\n  client-supplied filter merge file against the module filter list\n- CVE-2026-53789: keep implied parent directories non-content so a peer\n  cannot widen the scope of a --delete run\n- CVE-2026-53803: open the batch, motd, lock, log and config files\n  refusing attacker-planted symlinks, and refuse a non-regular\n  --read-batch file\n- CVE-2026-70459: reject a non-directory transfer-root file-list entry\n- CVE-2026-70463: parse \"auth users\" with conf_strtok so an @Group Name\n  entry containing a space is not torn in two","modified":"2026-10-26T09:31:58.527310015Z","published":"2026-09-09T11:01:20Z","upstream":["CVE-2026-53784","CVE-2026-53786","CVE-2026-53789","CVE-2026-53803","CVE-2026-70459","CVE-2026-70463"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1788951664.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:RHEL:7","purl":"pkg:rpm/tuxcare/rsync?distro=rhel-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els10"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1788951664.json"}}],"schema_version":"1.9.0"}