CVE-2026-53785: CWE-59 Improper Link Resolution Before File Access ('Link Following') in RsyncProject rsync
A path traversal vulnerability exists in rsync versions up to 3.4.4 that allows a malicious sender to write files outside the intended destination directory by exploiting symlink handling in --relative mode. The vulnerability arises because the make_path() function follows symlinks without verifying the final path remains within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
AI Analysis
Technical Summary
CVE-2026-53785 is a path traversal vulnerability in rsync before version 3.5.0. When using the --relative mode, the make_path() function improperly resolves symbolic links while creating intermediate directories. This lack of verification allows crafted relative paths containing symlink components to escape the intended destination directory tree, resulting in arbitrary file writes on the receiver's filesystem. This vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).
Potential Impact
An attacker who can send files to a vulnerable rsync receiver using --relative mode can cause files to be written outside the intended destination directory. This can lead to overwriting or creating arbitrary files on the receiver's filesystem, potentially compromising system integrity or security. The CVSS 4.0 base score is 6.9 (medium severity), reflecting local attack vector with low complexity and no user interaction required, but requiring some privileges on the receiver side.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using --relative mode with untrusted senders or restrict rsync usage to trusted sources only. Monitor vendor channels for updates and apply official patches once released.
CVE-2026-53785: CWE-59 Improper Link Resolution Before File Access ('Link Following') in RsyncProject rsync
Description
A path traversal vulnerability exists in rsync versions up to 3.4.4 that allows a malicious sender to write files outside the intended destination directory by exploiting symlink handling in --relative mode. The vulnerability arises because the make_path() function follows symlinks without verifying the final path remains within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
CVSS v4.0
Score 6.9medium
Affected software
RsyncProject
rsync
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-53785 is a path traversal vulnerability in rsync before version 3.5.0. When using the --relative mode, the make_path() function improperly resolves symbolic links while creating intermediate directories. This lack of verification allows crafted relative paths containing symlink components to escape the intended destination directory tree, resulting in arbitrary file writes on the receiver's filesystem. This vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).
Potential Impact
An attacker who can send files to a vulnerable rsync receiver using --relative mode can cause files to be written outside the intended destination directory. This can lead to overwriting or creating arbitrary files on the receiver's filesystem, potentially compromising system integrity or security. The CVSS 4.0 base score is 6.9 (medium severity), reflecting local attack vector with low complexity and no user interaction required, but requiring some privileges on the receiver side.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using --relative mode with untrusted senders or restrict rsync usage to trusted sources only. Monitor vendor channels for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-10T20:14:32.826Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7ddec4bf8831d5395cfc7e
Added to database: 08/13/2026, 15:12:04 UTC
Last enriched: 08/21/2026, 13:37:14 UTC
Last updated: 09/25/2026, 14:22:44 UTC
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.