- CVE-2026-53784: daemon module-root chdir escape under `use chroot = no` because change_dir() reached the module path with a plain chdir(), which followed a planted parent-component symlink and served files from outside the module; the module-root chdir now resolves through an ownership-checked O_NOFOLLOW path walk - CVE-2026-53802: arbitrary file read via symlinked operator-supplied input paths because --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/--exclude-from and the --password-file / daemon secrets file were opened by path, letting a planted symlink feed an arbitrary file to the filter parser or the authentication response; these now use the same ownership-checked path walk - CVE-2026-53803: arbitrary file write via symlinked operator-supplied output paths because --log-file, --write-batch/--read-batch and the daemon motd, lock and --config opens resolved by path, letting a planted symlink redirect a privileged write; these now use the same ownership-checked path walk, and --read-batch additionally requires a regular file or a FIFO - Note: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.