- CVE-2026-53793: path confinement bypass from an inner "/./" chroot module through an in-module symlink to a directory outside it, and through a ".." in the basis name a server sends to a pulling client - CVE-2026-29518: symlink race and in-module symlink escape left in the path calls of a "use chroot = no" daemon other than the opens and the mkstemp - CVE-2026-53784: module-root chdir guard moved onto the reworked change_dir() - CVE-2026-53802: --files-from and filter merge files on a daemon read through a daemon-owned symlink that leaves the module