Symlink Race Condition Vulnerability in rsync Affected by Local Attackers

CVE-2026-53799

What is CVE-2026-53799?

The vulnerability in rsync allows local attackers to exploit a symlink race condition, enabling them to apply arbitrary Access Control Lists (ACLs) or extended attributes to unintended files. This occurs by substituting a symlink during the window between the file writing process and the ACL or extended attribute assignment, potentially leading to unauthorized changes in file permissions. This flaw can permit elevated privileges, allowing attackers to manipulate system files outside the specified directory tree, posing a significant security risk.

References