Chroot inner-module escape via parent-component symlink in rsync (CVE-2026-53793)

rsync before 3.5.0 fails to properly confine paths when `use chroot = yes` is combined with a `/./ ` inner-module root: the kernel chroot constrains only the outer path, allowing a symlinked parent component inside the inner module to resolve to a sibling directory outside the confinement boundary, enabling unauthorized read or write access to files outside the module's subtree. A related variant allows a malicious peer to supply a forged `xname` delta-basis path carrying traversal components, causing the client to open an out-of-tree file as the delta basis and disclose its contents back to the server (transfer shaping / information disclosure) outside any chroot. Both the server-side chroot escape and the client-side basis-name disclosure affect the generator, receiver write/finish, module chdir, and receiver delta-basis open paths. Affected versions: - <= 3.4.4 We recommend updating to: 3.5.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44 Details: https://vuln.today/cve/CVE-2026-53793