CVE-2026-53800: rsync < 3.5.0 Symlink Race Condition via --remove-source-files
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Configuration
If you use rsync, avoid the vulnerable --remove-source-files feature in versions earlier than 3.5.0; disable it unless you upgrade to a version that is not affected by the rsync symlink race condition.
rsync --remove-source-files = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53800?
The severity of CVE-2026-53800 is rated as medium with a score of 4.7.
How do I fix CVE-2026-53800?
To fix CVE-2026-53800, upgrade rsync to version 3.5.0 or later.
What type of vulnerability is CVE-2026-53800?
CVE-2026-53800 is a race condition vulnerability.
What can attackers do with CVE-2026-53800?
Attackers can exploit CVE-2026-53800 to perform arbitrary file deletion.
Which versions of rsync are affected by CVE-2026-53800?
All versions of rsync prior to 3.5.0 are affected by CVE-2026-53800.