CVE-2026-53800
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.
Risk Assessment
An attacker can delete arbitrary files on the system to which they have access, potentially leading to data loss or system integrity compromise.
Recommendation
Update rsync to version 3.5.0 or later, which includes a fix, and avoid using --remove-source-files in environments where attackers can create symlinks.
Original NVD description (English source)
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.