CVE-2026-53803
Received Received - Intake

Symlink Following in rsync Before 3.5.0

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53803
EUVD
EUVD-2026-58089

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53803 is a symlink following vulnerability in rsync versions 3.4.4 and earlier. It allows local attackers to overwrite arbitrary files by exploiting predictable output paths such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can manipulate rsync into redirecting output to unintended filesystem locations, potentially leading to local privilege escalation when rsync runs with elevated privileges like setuid or privileged daemon configurations.

Detection Guidance

Check rsync version with 'rsync --version' to confirm if it is 3.4.4 or earlier. Inspect logs for suspicious --log-file, --write-batch, or daemon-mode log paths that may indicate symlink redirection attempts.

Impact Analysis

This vulnerability can allow attackers to overwrite critical files, gain elevated privileges, or execute arbitrary code on systems running vulnerable rsync versions. Attackers could append malicious content to sensitive files like /root/.ssh/authorized_keys or truncate important system files via --write-batch. The impact is higher on systems where rsync runs with elevated privileges.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Remove setuid permissions if not required. Audit and restrict access to rsync daemon configurations and log file paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart