CVE-2026-53803 PUBLISHED

rsync < 3.5.0 Symlink Following Arbitrary File Overwrite

Assigner: VulnCheck
Reserved: 10.06.2026 Published: 13.08.2026 Updated: 13.08.2026

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.5

Product Status

Vendor RsyncProject
Product rsync
Versions Default: unaffected
  • affected from 0 to 3.4.4 (incl.)
  • Version 3.5.0 is unaffected

Credits

  • seks99x finder

References

Problem Types

  • CWE-59 Improper Link Resolution Before File Access ('Link Following') CWE