PT-2026-71626
CVE-2026-53788
·
Published
2026-08-13
·
Updated
2026-10-08
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
rsync versions prior to 3.5.0
Description
A newline injection issue exists in the name-converter uid/gid mapping interface. Local attackers can forge protocol messages by creating user or group names that include newline characters. By injecting these characters into names sent via the pipe-based line-oriented protocol, an attacker can trick the rsync daemon into treating malicious data as legitimate protocol input, which corrupts the uid/gid mapping logic.
Recommendations
Update rsync to version 3.5.0 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾