CVE-2026-53797 describes a CWE-59 Improper Link Resolution Before File Access vulnerability in rsync before version 3.5.0. The issue arises from a symlink race condition in the sender's source tree traversal. An attacker with the ability to manipulate a parent directory of the source tree can atomically replace a directory component with a symlink pointing outside the source root between path resolution and file open operations. This allows unauthorized disclosure of files outside the intended transfer root during rsync operations.

The vulnerability enables an attacker with limited privileges (local access with the ability to manipulate directories) to cause rsync to read and disclose file contents outside the intended source directory. This can lead to unintended data exposure. The CVSS 4.0 score is 5.7 (medium severity), reflecting the requirement for local access and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided and the remediation level is null, users should monitor vendor communications for updates. Until a fix is available, avoid running rsync in environments where untrusted users can manipulate parent directories of the source tree.