RsyncProject rsync up to 3.4.4 Symlink Following log-file/write-batch symlink

Summaryinfo

A vulnerability was found in RsyncProject rsync up to 3.4.4. It has been declared as very critical. This vulnerability affects unknown code of the component Symlink Following. Such manipulation of the argument log-file/write-batch leads to symlink. This vulnerability is uniquely identified as CVE-2026-53803. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in RsyncProject rsync up to 3.4.4. Affected by this issue is some unknown processing of the component Symlink Following. The manipulation of the argument log-file/write-batch with an unknown input leads to a symlink vulnerability. Using CWE to declare the problem leads to CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. Impacted is confidentiality, integrity, and availability. CVE summarizes:

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-53803 since 06/10/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/13/2026).

Upgrading to version 3.5.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• File Transfer Software

Vendor

• RsyncProject

Name

• rsync

Version

• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4

Website

• Product: https://github.com/RsyncProject/rsync/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion