Privilege Confusion in rsync Before 3.5.0 by Rsync Project

CVE-2026-53798

What is CVE-2026-53798?

The rsync tool prior to version 3.5.0 presents a privilege confusion vulnerability within its name-converter subprocess related to uid/gid mapping. This vulnerability can be exploited by local attackers who manipulate name-converter responses to yield empty values. When uid or gid lookups return empty, rsync falsely interprets this as a resolution for uid/gid 0 (root), allowing unauthorized assignment of root ownership to transferred files. Consequently, this can lead to significant security risks where unauthorized users could have control over critical files.

References