CVE-2026-53789

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description Improper path handling allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree. By sending a crafted file list, an attacker can cause the receiver to reclassify implied parent directory entries or treat synthetic paths as the transfer root. This can be achieved through multiple methods, including implied parent reclassification, synthetic root path construction, non-directory root handling, and legacy protocol behavior below version 30, ultimately resulting in the deletion of files outside the authorized destination directory.

Recommendations Update rsync to version 3.5.0 or later.