Skip to main content

rsync CVE-2026-53793

| EUVDEUVD-2026-58101 CRITICAL
Improper Link Resolution Before File Access (CWE-59)
2026-08-13 VulnCheck
9.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.1 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

Network-reachable daemon with anonymous modules gives PR:N; dependence on a specific '/./' chroot config and forged transfers gives AC:H; high read/write access but no availability loss yields C:H/I:H/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:53 vuln.today
Analysis Generated
Aug 13, 2026 - 15:53 vuln.today
CVE Published
Aug 13, 2026 - 14:38 cve.org
CRITICAL 9.1

DescriptionCVE.org

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.

AnalysisAI

Path confinement bypass in the rsync daemon (versions before 3.5.0) lets remote clients escape the intended per-module chroot root when a module path contains a '/./' boundary marker, granting unauthorized read or write access to files outside the module subtree. Reported by VulnCheck and carrying a CVSS 4.0 score of 9.1, the flaw is exploitable by mishandling the '/./' notation or by forging delta-basis (xname) transfers that cross the boundary. No public exploit has been identified at time of analysis, but the fix is a coordinated advisory (GHSA-wj7w-vh23-mm44) shipped in the major 3.5.0 security release.

Technical ContextAI

rsync's daemon mode confines each client to a module subtree, and 'use chroot = yes' plus a module path written as '/srv/data/./module' uses the embedded '/./' as a chroot boundary marker - everything before '/./' becomes the chroot root and everything after is the module-relative inner path. The vulnerability is a CWE-59-class link/path resolution failure (Improper Link Resolution Before File Access): rsync fails to correctly re-anchor or canonicalize paths against this '/./' boundary, so crafted paths - or forged delta-basis 'xname' references used during incremental/basis transfers - resolve above the intended inner root. Affected component is the rsync file-transfer daemon itself (cpe:2.3:a:rsyncproject:rsync), specifically its chroot path-handling logic rather than any external library.

RemediationAI

Vendor-released patch: rsync 3.5.0 - upgrade all rsync daemon hosts to 3.5.0 or later, per the 3.5.0 security release (https://github.com/RsyncProject/rsync/releases/tag/v3.5.0) and advisory GHSA-wj7w-vh23-mm44. Where immediate patching is not possible, rewrite affected module definitions in rsyncd.conf to avoid the '/./' boundary-marker form and instead set the module 'path' to the full intended root without an embedded '/./', which removes the specific misparsing condition (side effect: changes the effective chroot root, so re-verify that clients still see the intended files). Additional compensating controls: require authenticated access by configuring 'auth users' and 'secrets file' on each module to remove anonymous exposure (trade-off: breaks anonymous mirrors); restrict the daemon with 'hosts allow'/'hosts deny' or a firewall limiting TCP 873 to trusted networks (trade-off: blocks legitimate remote clients not on the allowlist); and set 'read only = yes' where write access is not required to at least cap the integrity/write half of the impact (does not stop unauthorized reads). Consult the NEWS entry at https://download.samba.org/pub/rsync/NEWS#3.5.0 for full fix details.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t

CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa

CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i

CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv

CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character

CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_

CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by

CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-53793 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy