CVE-2026-53797
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.
Risk Assessment
Disclosure of file contents outside the intended source directory may occur, potentially compromising data confidentiality.
Recommendation
Update rsync to version 3.5.0 or later, which includes a fix, and secure source directories against manipulation by unauthorized users.
Original NVD description (English source)
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.