rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by… (CVE-2026-53795)

The vulnerability in rsync prior to version 3.5.0 allows an attacker to perform arbitrary file writes outside the intended destination directory. This is achieved by specifying an absolute path via the --temp-dir or --link-dest options, which bypasses the rename-confinement logic designed to restrict file writes within the destination tree. As a result, attacker-controlled values can cause files to be written to arbitrary locations accessible by the rsync process, potentially leading to integrity and availability impacts. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impact.

Successful exploitation allows an attacker to write files to arbitrary locations on the system accessible to the rsync process, potentially leading to integrity and availability issues such as overwriting critical files or disrupting service. There is no direct confidentiality impact reported. The vulnerability requires user interaction and can be exploited remotely over the network without privileges.

A fix is available in rsync version 3.5.0 and later. Users and administrators should upgrade to rsync 3.5.0 or a later patched version to remediate this vulnerability. Since no vendor advisory content was provided explicitly, patch status is inferred from the version information. No additional mitigations are specified.