CVE-2026-53801
Received Received - Intake

rsync Symlink Race Condition Before 3.5.0

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53801
EUVD
EUVD-2026-58039

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rsync rsync to 3.5.0 (exc)
rsync rsync to 3.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in rsync before 3.5.0 involves a symlink race condition during directory scanning. Attackers can replace a symlink with a directory entry pointing outside the intended module root between the lstat() and opendir() calls. This allows unauthorized access to files beyond the intended transfer root in both daemon and non-daemon modes.

Detection Guidance

To detect this vulnerability, check your rsync version with 'rsync --version'. If it is 3.4.3 or earlier, the system is vulnerable. Additionally, monitor for unusual file access patterns or unauthorized directory traversals in logs.

Impact Analysis

An attacker could exploit this to access files outside the intended directory structure during file transfers. This could lead to exposure of sensitive file names, metadata, or symlink targets, compromising confidentiality. The impact is higher in non-daemon sender scenarios where privileged users might inadvertently transfer restricted files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of file names, metadata, or symlink targets outside intended scopes may result in non-compliance, potential data breaches, and regulatory penalties due to compromised data protection measures.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, restrict symlink creation in rsync operations and avoid using options like --copy-dirlinks or --copy-unsafe-links in daemon mode.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart