CVE-2026-53801

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A symlink race condition exists in the sender's directory scanning logic. This occurs when an attacker manipulates symlinks in a path component of the scanned tree, replacing a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call. This allows the sender to enumerate and transfer files outside the intended subtree in both daemon-mode and non-daemon sender-side scanning.

Recommendations Update rsync to version 3.5.0 or later.