Skip to main content

rsync CVE-2026-53795

| EUVDEUVD-2026-58034 HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-08-13 VulnCheck
7.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Network-reachable with user interaction required to trigger the write; no privileges needed; write-only primitive yields no confidentiality impact but high integrity and availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.8 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:53 vuln.today
Analysis Generated
Aug 13, 2026 - 15:53 vuln.today
CVE Published
Aug 13, 2026 - 14:39 cve.org
HIGH 7.2

DescriptionCVE.org

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.

AnalysisAI

Arbitrary file write in rsync before 3.5.0 allows attackers who control --temp-dir or --link-dest option values to escape the intended destination tree by supplying absolute paths, bypassing the rename-confinement security boundary. Any filesystem location writable by the rsync process can be targeted, enabling overwrite of system files, configuration, or planted malicious content. No public exploit identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity and availability impact reflects serious real-world risk in server environments where option values are externally influenced.

Technical ContextAI

rsync implements a rename-confinement mechanism designed to ensure that temporary files (staged via --temp-dir) and hard-linked files (via --link-dest) remain within the declared destination directory during file transfer operations. CWE-59 (Improper Link Resolution Before File Access) describes the root cause: when either option is supplied with an absolute path that resolves outside the destination tree, the confinement check fails to detect the escape, allowing file operations to proceed against out-of-tree paths. The affected CPE cpe:2.3:a:rsyncproject:rsync:*:*:*:*:*:*:*:* covers all rsync versions maintained by the RsyncProject before the 3.5.0 security release. The flaw is in the server-side or client-side rsync process logic that validates option-supplied paths prior to rename operations.

RemediationAI

Upgrade to rsync 3.5.0 or later, the confirmed major security release that resolves this flaw (release page: https://github.com/RsyncProject/rsync/releases/tag/v3.5.0; full changelog vs. prior version: https://github.com/RsyncProject/rsync/compare/v3.4.4...v3.5.0). Where immediate upgrade is not possible, restrict the ability of untrusted callers to supply --temp-dir or --link-dest flags: audit all rsync invocations in automation pipelines and scripts to ensure these options are either hardcoded to safe paths or omitted entirely. Running rsync within a chroot jail confines potential writes to the jail root, limiting blast radius at the cost of added operational complexity. Ensuring the rsync process runs as an unprivileged, dedicated service account further bounds the filesystem locations an attacker could overwrite. Note that chroot and account isolation are compensating controls, not fixes - they do not eliminate the vulnerability.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t

CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa

CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i

CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv

CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character

CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_

CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by

CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-53795 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy