HIGHVulnerability
Verified
Global
NVD HIGH: CVE-2026-53795 — rsync before 3.5.0 contains an arbitrary file write vulnerability that allows at...
·Source: NIST NVD
Updated:
Executive Summary
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessib
Analysis
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process. CVSS Score: 8.1. Published: 2026-08-13T15:19:44.117.