CVE-2026-53797rsync < 3.5.0 Symlink Race Condition Information Disclosure

Beschreibung

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-3jj3-qvc7-jp6x) vendor-advisoryVendor Advisory
• rsync 3.5.0 Release Notes release-notesProductRelease Notes
• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-disclosure third-party-advisoryRelease NotesThird Party Advisory