CVE-2026-53801 is a CWE-59 Improper Link Resolution Before File Access vulnerability in rsync before version 3.5.0. The vulnerability arises from a race condition between the lstat() and opendir() calls during directory scanning on the sender side. An attacker capable of creating or manipulating symbolic links in the path components can replace a symlink with a directory entry pointing outside the intended module root, causing rsync to enumerate and transfer files beyond the intended subtree. This affects both daemon and non-daemon modes of operation.

Attackers able to manipulate symlinks in the sender's scanned directory can cause rsync to transfer files outside the intended module root, potentially exposing sensitive files that should not be shared. This can lead to unauthorized disclosure of data. The vulnerability does not require privileges or user interaction but has a high attack complexity due to the need to manipulate symlinks in the sender's file system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running rsync in environments where untrusted users can create or modify symlinks in the sender's directory tree. Restrict permissions to prevent unauthorized symlink creation or manipulation on the sender side.