CVE-2026-53802
HIGH
8,4
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,1
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Description
AI Translation Available
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.
61
UNIX Symbolic Link (Symlink) Following
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Applicable Platforms
All platforms may be affected
https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4
https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-foll…