Skip to content
fr Sign in
5.7 Medium

CVE-2026-53797 rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows…

Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

Affected products and versions

Product Affected versions Fixed in
rsync 3.5 earliest → < 3.5.0 3.5.0
rsync 3.4 earliest → 3.4.4 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of rsync

The 44 CVEs of rsync →
CVE-2026-119741 rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions 8.7 High CVE-2026-70452 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent… 9.1 Critical CVE-2026-70453 rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote… 8.7 High CVE-2026-70454 rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation… 7.6 High
Track this CVE