PT-2026-71641
CVE-2026-53803
·
Published
2026-08-13
·
Updated
2026-10-13
Description by
CVSS 4.0
8.5
HighMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
rsync versions prior to 3.5.0
Description
A symlink following issue exists where local attackers can overwrite arbitrary files by placing a symbolic link at a predictable output path. This occurs because the software fails to reject symlinks during ancillary file writes, allowing output to be redirected to arbitrary filesystem locations. This can lead to local privilege escalation on installations where the software runs with elevated privileges, such as setuid or privileged daemon configurations. Affected output paths include
--log-file, --write-batch, and daemon-mode log and statistics paths.Recommendations
Update rsync to version 3.5.0 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾