CVE-2026-53803: rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Compensating control
Ensure rsync is not run with elevated privileges (e.g., avoid setuid or privileged daemon configurations) on systems where rsync < 3.5.0 is present.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53803?
CVE-2026-53803 has a high severity rating of 7.8.
How do I fix CVE-2026-53803?
To mitigate CVE-2026-53803, upgrade rsync to version 3.5.0 or later.
What vulnerability does CVE-2026-53803 describe?
CVE-2026-53803 describes a symlink following vulnerability in rsync that allows local attackers to overwrite arbitrary files.
Who is affected by CVE-2026-53803?
Any user running rsync versions prior to 3.5.0 is at risk of CVE-2026-53803.
What can attackers do with CVE-2026-53803?
Attackers can exploit CVE-2026-53803 to overwrite arbitrary files by creating a symlink at a predictable output path.