CVE-2026-53797

Summary

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

Affected Software

Weaknesses

• CWE-59: CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-367: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-3jj3-qvc7-jp6x
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-disclosure

• ←Previous
• Next→