Link following in Rsync - CVE-2026-53801

 

Link following in Rsync - CVE-2026-53801

Published: August 13, 2026


Vulnerability identifier: #VU142279
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53801
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper link resolution before file access in the sender and daemon directory-scan logic when enumerating source directories. A remote attacker can manipulate a symlinked directory path to disclose sensitive information.

In non-daemon mode, exploitation relies on a race that swaps a parent path component to a symlink outside the transfer root between the file-list scan and the recursive directory open. In daemon symlink-following mode, an in-module symlinked directory pointing outside the served module can be enumerated, exposing entry names, metadata, and preserved symlink targets but not out-of-module file contents.


Affected software

Rsync

How to mitigate CVE-2026-53801

Install security update from vendor's website.

Rsync - update to 3.5.0

External References

Related Security Bulletins