CVE-2026-53801 in rsync
Summary
by MITRE • 08/13/2026
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The rsync vulnerability affecting versions prior to 3.5.0 represents a critical symlink race condition that fundamentally undermines the security boundaries of the file synchronization protocol. This flaw exists within the sender's directory scanning logic where the application performs a sequence of operations that create a window for malicious exploitation. The vulnerability stems from the improper handling of symbolic links during the enumeration process, specifically between the lstat() system call and the subsequent opendir() call. During this brief temporal window, an attacker with control over the filesystem can manipulate symlink targets to redirect the scanner's path traversal outside the designated module root, thereby exposing unauthorized files and directories.
The technical implementation of this race condition relies on the fundamental timing gap in rsync's directory traversal algorithm. When rsync processes a directory tree, it first calls lstat() to determine if a path component is a symbolic link, and then immediately follows up with opendir() to open the directory for further scanning. If an attacker can modify or create a symlink at any point in the scanned path between these two system calls, they can effectively redirect the scanner to traverse into directories outside the intended module root. This race condition manifests regardless of whether rsync operates in daemon mode or standalone sender mode, making it particularly dangerous as it affects both server and client configurations. The vulnerability is classified under CWE-367, which specifically addresses Time-of-Check to Time-of-Use (TOCTOU) flaws, where the state of a resource changes between verification and actual use.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can enable attackers to access files that should remain protected within restricted module boundaries. An attacker who gains the ability to manipulate symlinks in the scanned directory tree can potentially access sensitive system files, configuration data, or other restricted resources that exist outside the intended module root. This could lead to unauthorized data exfiltration, privilege escalation opportunities, or complete compromise of the rsync service's security model. The vulnerability is particularly concerning in multi-user environments where different users may have separate rsync modules with distinct access controls, as a single malicious symlink could expose all modules to unauthorized access.
Mitigation strategies for this vulnerability require immediate patching to rsync version 3.5.0 or later, which implements proper symlink handling and eliminates the race condition through enhanced path validation and atomic operations. Organizations should also implement strict filesystem permissions and access controls to limit the ability of untrusted users to create or modify symbolic links within rsync module directories. Network segmentation and firewall rules can further reduce the attack surface by limiting direct access to rsync daemons. The ATT&CK framework categorizes this vulnerability under T1059.001 for Command and Scripting Interpreter, as exploitation often involves manipulating filesystem structures to gain unauthorized access, and potentially T1566 for Phishing with Social Engineering, where attackers might use this vulnerability to gain initial access before escalating privileges through the compromised rsync service. System administrators should also monitor for unusual symlink creation patterns in rsync module directories and implement automated scanning tools to detect potential race condition exploitation attempts.