Arbitrary File Read Vulnerability in Rsync Daemon Process by Rsync

CVE-2026-53802

What is CVE-2026-53802?

Rsync before version 3.5.0 is vulnerable to an arbitrary file read issue stemming from improper handling of symlink following in configuration file inputs. Attackers can exploit this vulnerability by manipulating input parameters, such as --files-from or --password-file, allowing them to read sensitive files accessible to the rsync daemon process. This can be achieved by placing a symlink in a predictable path or by providing a --files-from input that escapes the daemon's root module, leading to unauthorized access to files on the system.

References