CVE-2026-53800 in Rsync
Summary
by MITRE • 08/13/2026
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in rsync versions prior to 3.5.0 represents a critical symlink race condition that fundamentally undermines the integrity of file operations within the synchronization process. This flaw specifically manifests within the --remove-source-files functionality, where the software's handling of symbolic links creates an exploitable window between file transfer completion and the subsequent unlink() system call. The vulnerability operates on the principle that an attacker with the ability to create symbolic links in the target directory can manipulate the file system state during this brief interval, effectively hijacking the deletion process.
The technical implementation of this race condition stems from rsync's failure to properly validate file types between the completion of data transfer and the execution of cleanup operations. When --remove-source-files is enabled, rsync transfers data and then attempts to remove the original source files, but does not perform adequate checks to ensure that the files being deleted are indeed the intended source files rather than symbolic links that may have been substituted by an attacker. This creates a temporal vulnerability where an attacker can atomically replace a legitimate source file with a symbolic link pointing to a target file of their choosing, causing rsync to delete the symlink target instead of the original source file.
The operational impact of this vulnerability extends beyond simple file deletion, as it allows attackers to potentially remove critical system files or files belonging to other users within the same directory namespace. The atomic substitution capability means that the attack can be executed without detection, as the system appears to function normally while silently deleting files that should remain intact. This vulnerability particularly affects systems where rsync is used with elevated privileges or in environments where multiple users have symlink creation permissions, creating a significant risk for privilege escalation and data integrity compromise.
From a cybersecurity perspective, this vulnerability aligns with common attack patterns described in the attack mitigation framework, specifically relating to race condition exploitation techniques and file system manipulation attacks. The flaw can be categorized under CWE-367 which addresses Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities, where an attacker exploits the gap between when a security check is performed and when the operation is executed. Additionally, this vulnerability may enable lateral movement within compromised systems as attackers can target critical system files or configuration files to establish persistence or escalate privileges.
The recommended mitigation strategy involves upgrading to rsync version 3.5.0 or later, which implements proper file type validation and eliminates the race condition through improved synchronization mechanisms. Organizations should also consider implementing additional controls such as restrictive directory permissions, limiting symlink creation capabilities in sensitive areas, and monitoring for unusual deletion patterns within rsync operations. System administrators should review existing rsync configurations to ensure that --remove-source-files is not used in environments where symlink attacks are possible, and implement proper access controls to prevent unauthorized symlink creation in target directories.