Skip to main content

rsync EUVDEUVD-2026-58101

| CVE-2026-53793 CRITICAL
Improper Link Resolution Before File Access (CWE-59)
2026-08-13 VulnCheck
Authentication Bypass Rsync Suse
9.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.1 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

Network-reachable daemon with anonymous modules gives PR:N; dependence on a specific '/./' chroot config and forged transfers gives AC:H; high read/write access but no availability loss yields C:H/I:H/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:53 vuln.today
Analysis Generated
Aug 13, 2026 - 15:53 vuln.today
CVE Published
Aug 13, 2026 - 14:38 cve.org
CRITICAL 9.1

DescriptionCVE.org

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.

AnalysisAI

Path confinement bypass in the rsync daemon (versions before 3.5.0) lets remote clients escape the intended per-module chroot root when a module path contains a '/./' boundary marker, granting unauthorized read or write access to files outside the module subtree. Reported by VulnCheck and carrying a CVSS 4.0 score of 9.1, the flaw is exploitable by mishandling the '/./' notation or by forging delta-basis (xname) transfers that cross the boundary. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Connect to rsync daemon on TCP 873
Delivery
Target module with /./ chroot root
Exploit
Craft path or forge delta-basis xname crossing boundary
Execution
Bypass path confinement
Impact
Read or write files outside module subtree
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target to be running rsync in daemon mode with chroot enabled ('use chroot = yes') and at least one module whose configured path contains a '/./' boundary marker separating the chroot root from the inner module root; the attacker must be a remote client able to reach the daemon (default TCP 873) and must either abuse the '/./' path-notation handling or forge a delta-basis (xname) transfer that references paths crossing that boundary. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N, VC:H/VI:H/VA:N) scores 9.1 and reflects a genuine tension: it is network-reachable and unauthenticated (PR:N) with high confidentiality and integrity impact, but AC:H combined with AT:P signals that exploitation is not turnkey - it requires a specific server-side configuration (a module path containing a '/./' boundary marker under chroot) and non-trivial attacker effort to construct crossing paths or forge delta-basis transfers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker connects as a remote client to an internet- or intranet-reachable rsync daemon whose module is defined under chroot with a '/./' boundary marker. By requesting paths that abuse the '/./' notation - or by forging a delta-basis transfer that references an xname path crossing the boundary - the attacker reads sensitive files (e.g., /etc credentials) or writes files outside the module subtree. …
Remediation Vendor-released patch: rsync 3.5.0 - upgrade all rsync daemon hosts to 3.5.0 or later, per the 3.5.0 security release (https://github.com/RsyncProject/rsync/releases/tag/v3.5.0) and advisory GHSA-wj7w-vh23-mm44. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running rsync daemon and confirm which are running versions prior to 3.5.0. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa
CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d
CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv
CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati
CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character
CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_
CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by
CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli
CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8
CVE-2024-57728 HIGH POC
7.2
CVE-2021-41379 MEDIUM
5.5

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

EUVD-2026-58101 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy