Skip to main content

rsync CVE-2026-53784

| EUVDEUVD-2026-58091 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-08-13 VulnCheck
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-reachable daemon, but AC:H for dual non-default conditions; PR:L for module access; scope changed since files outside module root are affected.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:56 vuln.today
Analysis Generated
Aug 13, 2026 - 15:56 vuln.today
CVE Published
Aug 13, 2026 - 14:34 cve.org
HIGH 8.4

DescriptionCVE.org

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.

AnalysisAI

Path traversal in rsync daemon before 3.5.0 allows remote rsync clients to read and write files outside the configured module root. The root cause is the daemon calling chdir() to the module root at session start without resolving symlinks via realpath(), so if the module root path or any path component is a symlink, subsequent relative-path operations resolve against the symlink target instead of the intended directory. Exploitation requires two server-side conditions - use chroot disabled and a symlink anywhere in the module root path - but no special conditions on the attacker side beyond having rsync client access to the module. No public exploit code or CISA KEV listing is identified at time of analysis.

Technical ContextAI

rsync is a widely-used open-source file synchronization utility. When run as a daemon, it serves named modules defined in rsyncd.conf. By default, the daemon uses chroot() to confine clients to the module root, which would prevent this class of attack. When use chroot = false, the daemon instead calls chdir() to the module root path at session initialization. The flaw (CWE-59: Improper Link Resolution Before File Access - Link Following) is that chdir() follows symlinks silently: if /srv/backup (the module root) is itself a symlink to /data/store, the daemon's working directory becomes /data/store. A remote client submitting relative path traversal sequences (e.g., ../../etc/) then resolves relative to /data/store rather than /srv/backup, escaping the intended confinement. The affected CPE is cpe:2.3:a:rsyncproject:rsync:*:*:*:*:*:*:*:* for all versions before 3.5.0.

RemediationAI

Vendor-released patch: rsync 3.5.0, available at https://github.com/RsyncProject/rsync/releases/tag/v3.5.0. Organizations should upgrade to 3.5.0 as the primary remediation. For systems that cannot immediately upgrade, two compensating controls apply: First, re-enable use chroot = true in rsyncd.conf for all modules - this is the default and eliminates the attack path entirely, though it prevents rsync from preserving hardlinks, ACLs, and device files, which may break some backup workflows. Second, audit all module root paths and their parent directories to ensure no path component is a symlink; replacing symlinks with bind mounts achieves the same filesystem layout without the resolution ambiguity. Note that neither workaround substitutes for patching, as the root cause (missing realpath() call) remains in older binaries. The full vendor security advisory is at https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t

CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa

CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i

CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv

CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character

CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_

CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by

CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-53784 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy