CVE-2026-53802
Received Received - Intake

Arbitrary File Read in rsync via Symlink Exploitation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53802
EUVD
EUVD-2026-58088

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in rsync before version 3.5.0 allows attackers to read arbitrary files accessible to the rsync daemon process by exploiting symlink following in configuration files. Attackers can place a symlink at a predictable path or supply a --files-from path that escapes the daemon module root to access sensitive files.

Detection Guidance

Check rsync version with 'rsync --version' to confirm if it is below 3.5.0. Inspect configuration files for --files-from, --password-file, or filter merge files that may contain symlinks pointing outside intended directories. Monitor logs for unusual file access patterns or errors related to symlink resolution.

Impact Analysis

This vulnerability can allow attackers to read sensitive files or disclose credentials by redirecting rsync to unintended locations. It may also enable manipulation of file transfers or bypass module confinement in daemon mode, potentially accessing files outside intended directories.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable or restrict access to rsync daemon mode if not required. Review and sanitize all --files-from, --password-file, and filter configuration files to remove any symlinks. Apply filesystem-level restrictions to prevent symlink traversal in rsync module roots.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart