rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate… (CVE-2026-53797)

The vulnerability in rsync before version 3.5.0 is a symlink race condition during the sender's source tree traversal. An attacker with the ability to manipulate a parent directory of the source tree can replace a directory component with a symlink to a location outside the intended source root between path resolution and file open operations. This redirection allows unauthorized disclosure of file contents outside the intended transfer root. The issue affects multiple specific versions of rsync, as listed, and has been publicly disclosed with a CVSS v3.1 score of 4.7 (medium severity).

An attacker who can manipulate the parent directory of the source tree can cause rsync to disclose file contents outside the intended transfer root. This results in unauthorized information disclosure but does not affect integrity or availability. The impact is limited to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or fix information is provided, users should monitor vendor advisories for updates and avoid running vulnerable versions in untrusted environments where directory manipulation is possible.