CVE-2026-53799
Received Received - Intake

Symlink Race Condition in rsync Before 3.2.7

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53799
EUVD
EUVD-2026-58037

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rsync rsync to 3.5.0 (exc)
rsync rsync to 3.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53799 is a symlink race condition in rsync versions before 3.5.0. It allows local attackers to manipulate ACLs or extended attributes applied to unintended files. The issue occurs when an attacker replaces a symlink at a predictable path between file write and metadata application, redirecting ACL/xattr to files outside the intended directory. This can grant elevated permissions and enable local privilege escalation.

Detection Guidance

To detect this vulnerability, check the installed rsync version with 'rsync --version'. If it is 3.4.3 or earlier, the system is vulnerable. Additionally, monitor for unusual ACL or xattr changes on sensitive files, as attackers may exploit this to modify permissions.

Impact Analysis

If you use rsync versions before 3.5.0, a local attacker could exploit this to gain elevated permissions on your system. They could modify ACLs or xattrs on unintended files, potentially accessing or altering sensitive data. In some cases, it could also cause a denial of service if a FIFO is involved.

Mitigation Strategies

Immediately upgrade rsync to version 3.5.0 or later. If upgrading is not possible, restrict local user access to rsync operations and avoid running rsync with elevated privileges. Monitor for suspicious file permission changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart