Skip to main content

rsync CVE-2026-53790

| EUVDEUVD-2026-58098 CRITICAL
OS Command Injection (CWE-78)
2026-08-13 VulnCheck
9.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Attacker must control injected host/env input or the connection target (AC:H) and a user must invoke rsync (UI:R); no auth needed (PR:N) and injected commands run with full C/I/A impact as the invoking user.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:56 vuln.today
Analysis Generated
Aug 13, 2026 - 15:56 vuln.today
CVE Published
Aug 13, 2026 - 14:37 cve.org
CRITICAL 9.2

DescriptionCVE.org

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.

AnalysisAI

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection - that let an attacker who controls hostnames, hostspecs, or related input inject shell metacharacters or newlines and run commands as the rsync process or invoking user. VulnCheck reported the cluster of CWE-78 flaws, which are fixed together in the major security release v3.5.0. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Control untrusted host/hostspec or env input
Delivery
Inject shell metacharacters or newline
Exploit
Feed value into vulnerable rsync path
Execution
rsync expands input via shell
Impact
Execute arbitrary commands as invoking user

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to control at least one specific input to a vulnerable code path: the RSYNC_CONNECT_PROG environment variable, a daemon hook configuration, the target host passed to the rsync-ssl wrapper, or a hostname/hostspec used in remote-shell command assembly - with shell metacharacters or newline characters embedded in that value. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) yields 9.2 and signals high technical impact with no privileges required, but AC:H correctly flags that exploitation is not trivial: the attacker must control the hostname/hostspec, environment, or the server the victim connects to, rather than fire a single unauthenticated packet at a listening service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An automation script or web-facing service builds an rsync command from a user-supplied hostname; an attacker submits a hostspec containing shell metacharacters or an embedded newline, and rsync expands it through one of the vulnerable paths (e.g. RSYNC_CONNECT_PROG or the rsync-ssl wrapper), executing the attacker's commands under the invoking user's privileges. …
Remediation Upgrade to rsync 3.5.0 or later, which fixes all of the reported command- and argument-injection paths together (Vendor-released patch: 3.5.0); see https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 and the advisory https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq, and apply the corresponding distribution package update where available. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running rsync and identify those on versions prior to 3.5.0, prioritizing production file synchronization servers and backup infrastructure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t

CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa

CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i

CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv

CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character

CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_

CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by

CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

CVE-2026-53791 CRITICAL
9.1 Aug 13

IP-based access control bypass in the rsync daemon (rsyncproject/rsync) before version 3.5.0 lets unauthenticated remote

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-53790 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy