Symlink Race Condition Vulnerability in Rsync by Rsync Project

CVE-2026-53800

What is CVE-2026-53800?

Rsync, prior to version 3.5.0, exhibits a vulnerability related to a symlink race condition in its --remove-source-files feature. This flaw enables attackers with permissions to create symlinks to potentially manipulate file operations, allowing them to replace a regular source file with a symlink. Consequently, when rsync attempts to delete the file after transfer, it may remove the target of the symlink instead of the intended source file, leading to arbitrary file deletion. This vulnerability highlights the importance of ensuring secure file transfer mechanisms and implementing appropriate safeguards against unauthorized symlink creation.

References