CVE-2026-53797

Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

Weakness classification

• CWE-59: Improper Link Resolution Before File Access ('Link Following')
• CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Primary references

• disclosure@vulncheck.com — Product, Release Notes
• disclosure@vulncheck.com — Vendor Advisory
• disclosure@vulncheck.com — Release Notes, Third Party Advisory