Path Traversal Vulnerability in rsync Affects File Transfers

CVE-2026-53785

What is CVE-2026-53785?

Rsync versions before 3.5.0 are susceptible to a path traversal vulnerability. This issue allows a malicious sender to exploit the file transfer process by constructing relative paths that include symlink components while using the --relative mode. The vulnerability arises because the make_path() function does not adequately validate the constructed paths, permitting arbitrary files to be written outside the intended destination directory tree on the receiver's filesystem. As a result, this can lead to significant security issues, including unauthorized file access and potential system compromise.

References