Link following in Rsync - CVE-2026-53801
Published: August 13, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper link resolution before file access in the sender and daemon directory-scan logic when enumerating source directories. A remote attacker can manipulate a symlinked directory path to disclose sensitive information.
In non-daemon mode, exploitation relies on a race that swaps a parent path component to a symlink outside the transfer root between the file-list scan and the recursive directory open. In daemon symlink-following mode, an in-module symlinked directory pointing outside the served module can be enumerated, exposing entry names, metadata, and preserved symlink targets but not out-of-module file contents.