rsync <3.5.0 Symlink Following Allows Local Privilege Escalation
CVE-2026-53803 Published on August 13, 2026
rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.
Vulnerability Analysis
CVE-2026-53803 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-53803 has been classified to as an insecure temporary file vulnerability or weakness.
Products Associated with CVE-2026-53803
Want to know whenever a new CVE is published for Samba Rsync? stack.watch will email you.
Affected Versions
RsyncProject rsync:- Before and including 3.4.4 is affected.
- Version 3.5.0 is unaffected.