CVE-2026-53795: rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1Fixed in 3.5.1+ds1-2Fixed in 3.5.2+ds1-1 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53795?
The severity of CVE-2026-53795 is rated as high with a score of 8.1.
How do I fix CVE-2026-53795?
To fix CVE-2026-53795, upgrade rsync to version 3.5.0 or later.
What is the risk associated with CVE-2026-53795?
CVE-2026-53795 has a risk score of 59, indicating a significant threat.
What are the consequences of CVE-2026-53795?
The consequences of CVE-2026-53795 include arbitrary file writes that can lead to unauthorized file modifications.
What versions of Rsync are affected by CVE-2026-53795?
Rsync versions prior to 3.5.0 are affected by CVE-2026-53795.