Link following in Rsync - CVE-2026-53803
Published: August 13, 2026
Vulnerability identifier: #VU142297
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53803
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to overwrite arbitrary files and escalate privileges.
The vulnerability exists due to improper link resolution before file access in rsync output and ancillary file path handling when opening operator-supplied paths such as --log-file, --write-batch, --read-batch, and daemon ancillary files. A local user can plant a symlink in the target path or a parent path component to overwrite arbitrary files and escalate privileges.
For --read-batch, a planted symlink, FIFO, or device can supply chosen bytes to the protocol parser.
Affected software
Rsync
How to mitigate CVE-2026-53803
Install security update from vendor's website.
Rsync - update to 3.5.0