CVE-2026-53795: rsyncproject rsync Link Following
Vulnerability summary
CVE-2026-53795 is a high (CVSS 8.1) Link Following vulnerability in rsyncproject rsync. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 8Timeline
- 13-08-2026PublishedVulnerability first disclosed.
- 14-08-2026Last modifiedVulnerability information updated.
Description
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- rsync< 3.5.0-r0
Debian1 product
- rsyncAll versions (No fix recorded) | < 3.5.0+ds1-0+deb13u1 | < 3.5.0+ds1-1
Rsyncproject1 product
- rsync≤ 3.4.4
Samba1 product
- rsync< 3.5.0
Ubuntu1 product
- rsyncAll versions (No fix recorded)
5 vendors · 5 products
References
9 links- www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-destThird Party AdvisoryRelease Notes
