CVE-2026-53799: rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Compensating control
Mitigate local exploitation by preventing untrusted local users from being able to replace files/symlinks in the rsync destination path during execution (e.g., ensure destination tree permissions prevent symlink substitution by untrusted users).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53799?
The severity of CVE-2026-53799 is classified as medium with a score of 6.3.
How do I fix CVE-2026-53799?
To fix CVE-2026-53799, upgrade rsync to version 3.5.0 or later.
What type of vulnerability is CVE-2026-53799?
CVE-2026-53799 is identified as a race condition vulnerability.
Who can exploit CVE-2026-53799?
CVE-2026-53799 can be exploited by local attackers with access to the system.
What is the impact of CVE-2026-53799?
The impact of CVE-2026-53799 allows attackers to apply arbitrary ACLs or extended attributes to unintended files.