Symlink Race Condition Vulnerability in Rsync by Rsync Project

CVE-2026-53797

What is CVE-2026-53797?

Rsync versions prior to 3.5.0 are prone to a symlink race condition that can be exploited during the sender's source tree traversal process. This vulnerability allows an attacker with control over a parent directory of the source tree to redirect file reads, effectively accessing unintended file paths. By atomically replacing a component of a parent directory with a symlink that points outside the designated source root, attackers may disclose sensitive file contents. It is crucial for users to upgrade to versions 3.5.0 or later to mitigate this risk.

References