CVE-2026-53800

Analyzed Analyzed - Analysis Complete

Symlink Race Condition in rsync Leading to Arbitrary File Deletion

Publication date: 2026-08-13

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-31

Generated

2026-09-03

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-53800

EUVD

EUVD-2026-58038

Affected Vendors & Products

Vendor	Product	Version / Range
samba	rsync	to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a symlink race condition in rsync versions before 3.5.0, specifically in the --remove-source-files feature. Attackers with symlink creation access can replace a source file with a symlink between file transfer completion and the unlink() call. This causes rsync to delete the symlink target instead of the intended source file.

Detection Guidance

Check rsync version with 'rsync --version'. If it shows version 3.4.3 or earlier, the system is vulnerable. Monitor logs for unexpected file deletions when --remove-source-files is used.

Impact Analysis

This vulnerability can lead to arbitrary file deletion outside the intended source tree. It may cause denial of service or privilege escalation if rsync runs as root. Attackers could exploit it to delete critical system files or sensitive data.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file deletion. GDPR requires data integrity and protection, while HIPAA mandates safeguards for protected health information. Arbitrary file deletion could lead to data loss or unauthorized access, violating these standards.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later. Avoid using the --remove-source-files option until patched. Restrict symlink creation permissions for users running rsync.

Hi! I’m here to help you understand CVE-2026-53800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70