Hi there, You may have seen the recent unusually long list of CVEs for rsync. Here's my assessment of how they affect rsync-bpc, and may therefore affect BackupPC installations which use rsync-bpc.
First, though, if you use rsync itself (as opposed to the modified version of rsync embodied in rsync-bpc) be aware that some of these CVEs can theoretically be exploited by a remote peer so the previous advice about rsync itself still stands: (1) on no account expose rsync directly to the Internet and (2) as soon as possible upgrade all copies of rsync. Even if you do not yourself use rsync, it may be that a vulnerable version could be somehow used in an attack exploiting multiple vulnerabilities. This kind of thing is increasingly an issue as the Bad Guys find more and more ways to use AI in their toolkits. Of course do not expose BackupPC to the Internet. If you do need to back up remote hosts use an encrypted channel such as a VPN or set up rsync-over-SSH (BackupPC's configuration file shows a way to do that). If you do not use rsync-bpc for backups you can stop reading now. :) The list below is taken from "NEWS for rsync 3.5.0 (13 Aug 2026)" at https://download.samba.org/pub/rsync/NEWS.md So that I could group the CVEs into those that can affect rsync-bpc and those that can't, this list does not follow the order in which they're given in NEWS.md. Within the groups I've sorted them in order of severity. Firstly the issues that I assess as not affecting rsync-bpc/BackupPC: --------------------------------------------------------------------- rsync: - CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping ... - CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation ... - CVE-2026-53785 (HIGH): Under `--relative` ... - CVE-2026-53784 (HIGH): Daemon module-root chdir escape ... - CVE-2026-53793 (HIGH): Chroot `/./` inner-module escape ... - CVE-2026-53795 (HIGH): An absolute `--temp-dir` or `--link-dest` ... - CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time `chdir()` ... - CVE-2026-53797 (MEDIUM): A non-daemon sender ... - CVE-2026-53799 (MEDIUM): ... granting rwx on a root-owned file. ... - CVE-2026-53800 (MEDIUM): ... delete a file outside the served tree. ... - CVE-2026-53801 (MEDIUM): ... out-of-tree disclosure. ... The eleven CVEs above are link following attacks, so need a privileged rsync. BackupPC runs rsync-bpc runs as an unprivileged user (usually 'backuppc', but see $Conf{BackupPCUser}) so they are not applicable to a BackupPC installation. Also, when writing, in any case rsync-bpc overrides the destination file location to the BackupPC pool - it does not write to arbitrary locations in a potential victim filesystem. - CVE-2026-53791 (CRITICAL): With `proxy protocol = true` ... - CVE-2026-70464 (HIGH): ... complete the `@RSYNCD` greeting and then stall ... - CVE-2026-70455 (HIGH): ... request an arbitrary Zstandard worker count ... - CVE-2026-70453 (HIGH): quadratic CPU exhaustion ... - CVE-2026-70452 (HIGH): `hosts deny` failed OPEN ... - CVE-2026-70463 (HIGH): `auth users` ignored its documented comma-only ... - CVE-2026-70460 (HIGH): ... an in-module symlink could redirect ... - CVE-2026-70457 (MEDIUM): attacker-chosen-offset ... forwarded to a daemon. - CVE-2026-70459 (MEDIUM): ... crashing ... daemon child ... - CVE-2026-53786 (MEDIUM): ... bypassed the module filter list ... - CVE-2026-53798 (MEDIUM): ... stored metadata became root-owned. ... - CVE-2026-53788 (MEDIUM): ... name containing a newline/CR ... BackupPC does not use rsync-bpc as a daemon, so it is not vulnerable to the above twelve CVEs. - CVE-2026-53792 (MEDIUM): A malicious receiver ... BackupPC would be the malicious receiver in this case. Easy fix. - CVE-2026-53790 (HIGH): ... injection via `RSYNC_CONNECT_PROG` `%H` ... BackupPC is entirely in control of the connection arguments so this is a no-op - you can do whatever you like in .../BackupPC/config.pl and there's no fix for that! rrsync, rsync-ssl: - CVE-2026-53783 (HIGH): rrsync restricted-directory escape. - CVE-2026-70454 (MEDIUM): `rsync-ssl` ... unauthenticated TLS connection. ... BackupPC uses neither rrsync nor rsync-ssl so the above two CVEs are not relevant to a BackupPC installation. Secondly the issues I assess as possibly affecting rsync-bpc/BackupPC: ---------------------------------------------------------------------- - CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write ... - CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry ... - CVE-2026-70456 (HIGH): an out-of-bounds heap write in `read_args()` ... The above three issues will take first priority. Two of them write out of bounds by only one byte, but out of bounds is out of bounds - you can never really be sure what damage might be done. - CVE-2026-53789 (MEDIUM): ... daemon-sender could widen `--delete` scope ... An attack based on the above vulnerability is plausible if a client that BackupPC serves has been compromised. It seems possible that an attack might result in the deletion of pool files although it would be quite a lot of work for probably very limited reward. It doesn't seem to me to be a serious issue but it will be next on my list. - CVE-2026-70462 (MEDIUM): a peer-supplied `MSG_IO_TIMEOUT` ... - CVE-2026-53794 (MEDIUM): `--max-alloc=0` disabled the ... cap ... Timeout and max-alloc arguments would normally be set by the BackupPC server so these seem like minor issues and they are easily fixed. Aside from compromising the BackupPC server itself, exploitation of the above six vulnerabilities would be challenging but potentially doable if an attacker had say unfettered access to a compromised host on the same network as the BackupPC server. I think it should be straightforward to port the upstream fixes to the most recently released rsync-bpc versions (3.1.3.2 and 3.1.2.3) and I'll be working on that until further notice. I'll keep the list updated on progress. -- 73, Ged. _______________________________________________ BackupPC-users mailing list [email protected] List: https://lists.sourceforge.net/lists/listinfo/backuppc-users Wiki: https://github.com/backuppc/backuppc/wiki Project: https://backuppc.github.io/backuppc/
