CVE-2026-53785 in rsync
Summary
by MITRE • 08/13/2026
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The rsync path traversal vulnerability present in versions prior to 3.5.0 represents a critical security flaw that undermines the integrity of file synchronization operations across networked systems. This vulnerability specifically affects the --relative mode functionality where rsync processes relative paths containing symbolic link components, creating opportunities for malicious actors to exploit the software's path handling mechanisms. The flaw exists within the make_path() function which lacks proper boundary checking when traversing symbolic links during directory creation, allowing attackers to manipulate file placement beyond intended destinations.
The technical implementation of this vulnerability stems from insufficient validation of symbolic link targets during path resolution. When rsync processes relative paths in --relative mode, the make_path() function executes without verifying whether intermediate directories being created through symlink traversal remain within the designated destination tree boundaries. This failure to enforce path containment allows attackers to craft malicious relative paths that include symbolic links pointing to locations outside the intended target directory structure. The vulnerability operates at the filesystem level where the software's directory creation logic follows symlinks without proper access control enforcement, effectively bypassing normal security boundaries.
The operational impact of this vulnerability extends beyond simple file overwrites to encompass potential system compromise and data integrity violations. Attackers can leverage this flaw to write arbitrary files to locations outside the intended synchronization scope, potentially targeting critical system directories or configuration files. The vulnerability enables malicious actors to perform unauthorized modifications to the receiver's filesystem, creating opportunities for persistent access, privilege escalation, or data exfiltration. The implications are particularly severe in enterprise environments where rsync is commonly used for automated backups, file distribution, and system synchronization operations.
Security mitigations for this vulnerability require immediate software updates to rsync version 3.5.0 or later, which implements proper boundary checking within the make_path() function. Organizations should also consider implementing additional controls such as restricting rsync access through network segmentation, employing strict file permission controls on destination directories, and monitoring synchronization operations for anomalous path patterns. The vulnerability aligns with CWE-22 Path Traversal and ATT&CK technique T1059 Command and Scripting Interpreter, representing a classic example of insufficient input validation that enables unauthorized filesystem manipulation. System administrators should conduct comprehensive vulnerability assessments to identify systems running affected rsync versions and ensure proper patch management procedures are in place to prevent exploitation attempts.