CVE-2026-53785
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
39/100
Published: 2026-08-13
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
None
VC:
None
VI:
High
VA:
High
Description
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.