Improper Path Handling in rsync Affects Data Integrity

CVE-2026-53789

What is CVE-2026-53789?

Rsync versions earlier than 3.5.0 are susceptible to an improper path handling vulnerability. This flaw enables malicious actors to manipulate delete operations, resulting in potential unauthorized file deletions beyond the intended directories. Attackers can exploit this vulnerability by sending a specially crafted file list, which causes rsync to misinterpret directory entries and synthetic paths. Such exploitation could allow files outside the specified destination subtree to be deleted, raising significant concerns for data integrity and security.

References