Rsync 3.5.0 Path Traversal via Symlink in --relative Mode
CVE-2026-53785 Published on August 13, 2026
rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
Vulnerability Analysis
CVE-2026-53785 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-53785 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-53785
Want to know whenever a new CVE is published for Samba Rsync? stack.watch will email you.
Affected Versions
RsyncProject rsync:- Before and including 3.4.4 is affected.
- Version 3.5.0 is unaffected.