CVE-2026-53803 describes a vulnerability in rsync before version 3.5.0 where the software improperly resolves symbolic links before writing ancillary files like --log-file, --write-batch, or daemon-mode logs. Attackers with local access can exploit this by placing symlinks at these output paths, causing rsync to overwrite arbitrary files. This flaw arises because rsync fails to reject symlinks during these file writes, enabling redirection of output to unintended filesystem locations. The vulnerability can be leveraged for local privilege escalation on systems where rsync operates with elevated privileges.

Local attackers can overwrite arbitrary files on the filesystem by exploiting symlink redirection during ancillary file writes. This can lead to local privilege escalation on systems where rsync runs with elevated privileges such as setuid or privileged daemon configurations. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running rsync with elevated privileges or restrict local user access to systems running vulnerable versions. Monitor vendor channels for updates and apply patches once released.