Search: CVE-2026-53785

A path traversal vulnerability (CWE-59) exists in rsync versions up to 3.4.4. This flaw allows a malicious sender to write files outside the intended destination directory by exploiting symlink resolution in --relative mode. The vulnerability arises because the make_path() function follows symlinks without verifying that the resulting paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.