CVE-2026-53795
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
Risk Assessment
The risk includes the possibility of writing files to arbitrary locations, which could lead to system integrity compromise or privilege escalation.
Recommendation
It is recommended to upgrade rsync to version 3.5.0 or later and validate paths provided in --temp-dir and --link-dest options.
Original NVD description (English source)
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.