Skip to main content

rsync CVE-2026-53796

| EUVDEUVD-2026-58035 MEDIUM
Improper Link Resolution Before File Access (CWE-59)
2026-08-13 VulnCheck
5.8
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.8 MEDIUM
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Local filesystem race requiring low-privilege write access to path parent (AV:L/AC:H/PR:L); no confidentiality impact; high integrity and availability from uncontrolled file write redirection.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
6.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 16:07 vuln.today
Analysis Generated
Aug 13, 2026 - 16:07 vuln.today
CVE Published
Aug 13, 2026 - 14:39 cve.org
MEDIUM 5.8

DescriptionCVE.org

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.

AnalysisAI

TOCTOU race condition in rsync before 3.5.0 allows a local attacker who controls parent directory components of the destination path to redirect file writes to arbitrary filesystem locations outside the intended destination tree. Exploitation targets the non-daemon receiver code path, where a symlink can be substituted for a path component between rsync's path resolution step and its chdir() call. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released fix is rsync v3.5.0.

Technical ContextAI

rsync (CPE: cpe:2.3:a:rsyncproject:rsync:*:*:*:*:*:*:*:*) is a ubiquitous Unix/Linux file synchronization utility. CWE-59 (Improper Link Resolution Before File Access - 'Link Following') describes the root cause class: the program resolves a path and then acts on it without holding a lock, creating a window for an attacker to substitute a symlink. Specifically, the non-daemon receiver resolves the destination path and then calls chdir() - if a path component is replaced with a symlink in between, the working directory is established outside the intended destination tree, and all subsequent relative-path writes by the receiver follow the attacker-controlled symlink target.

RemediationAI

Upgrade to rsync version 3.5.0 or later, which is designated a major security release by the vendor and addresses this TOCTOU flaw directly. The release notes reference https://download.samba.org/pub/rsync/NEWS#3.5.0 for full security details, and the advisory is at https://github.com/RsyncProject/rsync/security/advisories/GHSA-w75h-ccff-w53m. If immediate patching is not possible, restrict write permissions on all parent directories of rsync destination paths so that untrusted local users cannot create or replace path components - this eliminates the attacker's ability to insert symlinks during the race window, though it does not fix the underlying code and should be treated as a temporary compensating control only. Avoid running rsync transfers to destinations whose parent directory tree is writable by untrusted accounts.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t

CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa

CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i

CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv

CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati

CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character

CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_

CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by

CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-53796 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy