CVE-2026-53802
rsync < 3.5.0 Arbitrary File Read via Symlink Following
- State
- Published
- Severity
- 8.4 High
- Published
- Aug 13, 2026
- Updated
- Aug 14, 2026
- Reserved
- Jun 10, 2026
Description
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-61 UNIX Symbolic Link (Symlink) Following
Affected Products
| Product | Versions |
|---|---|
rsyncRsyncProject |
|
References
- GitHub Security Advisory (GHSA-4mfr-8jrv-49x4)vendor-advisory
- rsync 3.5.0 Release Notesrelease-notes
- https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-followingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.