CVE-2026-53797 describes a symlink race condition in rsync before version 3.5.0. The vulnerability occurs during the sender's source tree traversal, where an attacker who can control a parent directory component can atomically replace it with a symlink pointing outside the source root between path resolution and file open operations. This improper link resolution (CWE-59) allows disclosure of files outside the intended transfer directory, potentially exposing sensitive information. The CVSS 4.0 base score is 5.7, indicating medium severity, with attack vector local, high complexity, and low privileges required.

An attacker with local access and the ability to manipulate a parent directory of the source tree can cause rsync to read and disclose files outside the intended source directory. This can lead to unauthorized disclosure of sensitive files during an rsync operation. There is no indication of remote exploitation or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the RsyncProject advisories for updates. Until a fix is available, avoid running rsync with source directories that can be manipulated by untrusted users or processes.