CVE-2026-53801: rsync < 3.5.0 Symlink Race Condition Directory Traversal
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53801?
CVE-2026-53801 has a medium severity rating of 5.9.
How do I fix CVE-2026-53801?
To fix CVE-2026-53801, upgrade rsync to version 3.5.0 or later.
What does CVE-2026-53801 exploit?
CVE-2026-53801 exploits a symlink race condition in the sender's directory scanning logic.
Who is affected by CVE-2026-53801?
Any user or system utilizing rsync versions prior to 3.5.0 is affected by CVE-2026-53801.
What type of attack is possible with CVE-2026-53801?
CVE-2026-53801 allows attackers to perform directory traversal and enumerate files outside the intended directory.