CVE-2026-53803

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A symlink following issue exists where local attackers can overwrite arbitrary files by placing a symbolic link at a predictable output path. This occurs because the software fails to reject symlinks during ancillary file writes, allowing output to be redirected to arbitrary filesystem locations. This can lead to local privilege escalation on installations where the software runs with elevated privileges, such as setuid or privileged daemon configurations. Affected output paths include --log-file, --write-batch, and daemon-mode log and statistics paths.

Recommendations Update rsync to version 3.5.0 or later.