HIGH 8.4 NVD
CVE-2026-53802
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlin
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4
- https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4
This high severity vulnerability with a CVSS score of 8.4 was published on 2026-08-13 via NVD.
vulnfeed aggregates 10617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.