CVE-2026-53785

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A path traversal issue exists when using --relative mode. A malicious sender can write files outside the intended destination directory tree by crafting relative paths containing symlink components. This occurs because the make path() function follows symlinks pointing outside the destination tree during the creation of intermediate directories without verifying that the resulting paths remain within the destination boundary, allowing arbitrary file writes on the receiver's filesystem.

Recommendations Update rsync to version 3.5.0 or later.