5.7
Medium
CVE-2026-53800 rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows…
Description
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.
Affected products and versions
Other CVEs of rsync
The 44 CVEs of rsync →
CVE-2026-119741
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
8.7
High
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent…
9.1
Critical
CVE-2026-70453
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote…
8.7
High
CVE-2026-70454
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation…
7.6
High