Skip to main content

rsync CVE-2026-53783

| EUVDEUVD-2026-58090 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-08-13 VulnCheck
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.6 CRITICAL

Network-accessible via SSH; flag-bypass path makes AC:L appropriate; rrsync directory escape constitutes scope change; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:58 vuln.today
Analysis Generated
Aug 13, 2026 - 15:58 vuln.today
CVE Published
Aug 13, 2026 - 14:34 cve.org
HIGH 8.6

DescriptionCVE.org

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

AnalysisAI

Directory escape in rsync's rrsync restricted shell wrapper before version 3.5.0 allows authenticated users to read and write files outside their enforced directory boundaries via two distinct paths. The first is a TOCTOU race condition that substitutes a symlink after path validation but before file transfer; the second is direct abuse of unrestricted rsync flags - --copy-unsafe-links, -D, and --log-file - that rrsync fails to sanitize, requiring no race timing at all. Scored 8.6 (High) under CVSS 4.0 with full confidentiality and integrity compromise of the vulnerable system, this is a genuine priority for any deployment using rrsync for SSH-based restricted file sharing; no public exploit has been identified at time of analysis.

Technical ContextAI

rsync is a ubiquitous file synchronization utility; rrsync is its companion restricted shell wrapper, typically deployed as an SSH ForceCommand in authorized_keys entries to confine a given client's rsync sessions to a designated directory subtree. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access - 'Link Following'), which encompasses TOCTOU flaws: rrsync validates the requested path, then an exploitable window exists before file transfer begins during which an attacker can substitute a symlink at a path component, causing rsync to resolve to an unintended target outside the restriction. Independently - and more deterministically - rrsync also fails to block certain rsync flags (--copy-unsafe-links, which follows symlinks pointing outside the tree; -D, which transfers device and special files; and --log-file, which can write arbitrary log output to any writable path) that an authenticated client can pass directly in their rsync invocation. The CPE cpe:2.3:a:rsyncproject:rsync:*:*:*:*:*:*:*:* covers all rsyncproject rsync versions prior to the fix.

RemediationAI

The primary fix is to upgrade rsync to version 3.5.0, available at https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 and documented in the security advisory at https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5. If an immediate upgrade is not feasible, administrators should consider disabling rrsync entirely and replacing it with a chroot jail or containerized rsync instance to enforce directory restrictions at the OS level rather than relying on the wrapper - this eliminates the attack surface but requires infrastructure changes. If rrsync must remain in use, the rrsync script can be manually patched to explicitly reject the --copy-unsafe-links, -D, and --log-file flags; however, this is fragile and risks being overwritten on the next package upgrade. Additionally, restricting which clients can invoke rrsync via SSH from= directives in authorized_keys limits exposure to trusted IP ranges but does not remediate the underlying flaw and offers no protection if a trusted client is compromised.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t

CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa

CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i

CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv

CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character

CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_

CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by

CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-53783 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy