CVE-2026-53795
Full vulnerability record from the local CVENow database.
Description
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
Severity
HIGH
CVSS score
7.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-13 15:19:44.117000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON
{
"id": "CVE-2026-53795",
"sourceIdentifier": "[email protected]",
"published": "2026-08-13T15:19:44.117",
"lastModified": "2026-10-24T16:10:00.153",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process."
},
{
"lang": "es",
"value": "rsync anterior a 3.5.0 contiene una vulnerabilidad de escritura de archivos arbitraria que permite a los atacantes escribir archivos fuera del árbol de destino previsto especificando una ruta absoluta a través de las opciones --temp-dir o --link-dest. La lógica de confinamiento de renombrado es eludida cuando estas opciones se resuelven en rutas fuera del árbol de destino, permitiendo que valores controlados por el atacante escriban archivos en ubicaciones arbitrarias accesibles al proceso rsync."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "RsyncProject",
"product": "rsync",
"defaultStatus": "unaffected",
"repo": "https://github.com/RsyncProject/rsync",
"packageURL": "pkg:github/RsyncProject/rsync",
"versions": [
{
"version": "0",
"lessThanOrEqual": "3.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "3.5.0",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-14T19:16:55.836803Z",
"id": "CVE-2026-53795",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.0",
"matchCriteriaId": "6985EC7E-B9D3-4BD6-96F9-43F8322282E7"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest",
"source": "[email protected]",
"tags": [
"Release Notes",
"Third Party Advisory"
]
}
]
}