CVE-2026-53799
Full vulnerability record from the local CVENow database.
Description
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.
Severity
HIGH
CVSS score
7.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-13 15:19:52.130000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON
{
"id": "CVE-2026-53799",
"sourceIdentifier": "[email protected]",
"published": "2026-08-13T15:19:52.130",
"lastModified": "2026-10-24T16:10:00.153",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation."
},
{
"lang": "es",
"value": "rsync anterior a la versión 3.5.0 contiene una vulnerabilidad de condición de carrera de enlace simbólico que permite a atacantes locales hacer que rsync aplique ACLs arbitrarias o atributos extendidos a archivos no deseados al sustituir un enlace simbólico en una ruta de destino predecible entre la escritura del archivo y la subsiguiente llamada a acl_set_file() o lsetxattr(). Los atacantes pueden explotar esta ventana de tiempo para redirigir la aplicación de ACL y xattr a través de un enlace simbólico manipulado a archivos fuera del árbol de destino previsto, lo que podría otorgar permisos elevados y permitir la escalada de privilegios local."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "RsyncProject",
"product": "rsync",
"defaultStatus": "unaffected",
"repo": "https://github.com/RsyncProject/rsync",
"packageURL": "pkg:github/RsyncProject/rsync",
"versions": [
{
"version": "0",
"lessThanOrEqual": "3.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "3.5.0",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.0,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-14T18:02:59.434021Z",
"id": "CVE-2026-53799",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-59"
},
{
"lang": "en",
"value": "CWE-367"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.0",
"matchCriteriaId": "6985EC7E-B9D3-4BD6-96F9-43F8322282E7"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-phxh-hjqv-39c9",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-acl-xattr-application",
"source": "[email protected]",
"tags": [
"Release Notes",
"Third Party Advisory"
]
}
]
}