CVE-2026-53789
Received Received - Intake

Improper Path Handling in Rsync Leading to Unauthorized File Deletion

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53789
EUVD
EUVD-2026-58097

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects rsync versions before 3.5.0. It involves improper path handling that allows a malicious sender to manipulate the --delete operation by sending a crafted file list. This can cause rsync to delete files outside the intended destination directory through methods like implied parent reclassification or synthetic root path construction.

Detection Guidance

Check rsync version with 'rsync --version'. If it shows a version before 3.5.0, the system is vulnerable. Monitor network traffic for rsync commands using --delete with crafted file lists. Look for unexpected file deletions in logs.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized deletion of files outside the intended directory. This may result in data loss, system disruption, or compromise of sensitive information if critical files are deleted.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable rsync --delete operations if not essential. Restrict rsync access to trusted senders only. Review and audit rsync configurations and file transfer logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart