Link following in Rsync - CVE-2026-53785
Published: August 13, 2026
Vulnerability identifier: #VU142294
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53785
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to create files and directories outside the destination tree.
The vulnerability exists due to improper link resolution before file access in make_path() when re-creating implied parent directories under --relative transfers. A local user can plant a symlink in a parent path component to create files and directories outside the destination tree.
The issue occurs on the receiver side while handling transferred paths with implied parent directories.
Affected software
Rsync
How to mitigate CVE-2026-53785
Install security update from vendor's website.
Rsync - update to 3.5.0