CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0	Product Release Notes
https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm	Vendor Advisory
https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal	Release Notes Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) rsync anterior a 3.5.0 contiene una vulnerabilidad de condición de carrera de enlace simbólico en la lógica de escaneo de directorios del remitente que permite a los atacantes hacer que el remitente enumere y transfiera archivos fuera del subárbol previsto de la raíz del módulo. Atacantes que pueden crear o manipular enlaces simbólicos en un componente de ruta del árbol escaneado pueden reemplazar un enlace simbólico con una entrada de directorio que apunta fuera de la raíz del módulo entre la llamada a lstat() y la subsiguiente llamada a opendir(), exponiendo archivos más allá de la raíz prevista tanto en el escaneo del lado del remitente en modo demonio como en modo no demonio.

Information

Published : 2026-08-13 15:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-53801

Mitre link : CVE-2026-53801

CVE.ORG link : CVE-2026-53801

JSON object : View

Products Affected

samba

rsync

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-53801", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53801", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T15:51:53.999454Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RsyncProject/rsync", "vendor": "RsyncProject", "product": "rsync", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.4"}, {"status": "unaffected", "version": "3.5.0", "versionType": "semver"}], "packageURL": "pkg:github/RsyncProject/rsync", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T15:19:52.623", "references": [{"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "tags": ["Product", "Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal", "tags": ["Release Notes", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "rsync before 3.5.0\u00a0contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning."}, {"lang": "es", "value": "rsync anterior a 3.5.0 contiene una vulnerabilidad de condici\u00f3n de carrera de enlace simb\u00f3lico en la l\u00f3gica de escaneo de directorios del remitente que permite a los atacantes hacer que el remitente enumere y transfiera archivos fuera del sub\u00e1rbol previsto de la ra\u00edz del m\u00f3dulo. Atacantes que pueden crear o manipular enlaces simb\u00f3licos en un componente de ruta del \u00e1rbol escaneado pueden reemplazar un enlace simb\u00f3lico con una entrada de directorio que apunta fuera de la ra\u00edz del m\u00f3dulo entre la llamada a lstat() y la subsiguiente llamada a opendir(), exponiendo archivos m\u00e1s all\u00e1 de la ra\u00edz prevista tanto en el escaneo del lado del remitente en modo demonio como en modo no demonio."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6985EC7E-B9D3-4BD6-96F9-43F8322282E7", "versionEndExcluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}