What is CVE-2026-53802?
rsync versions before 3.5.0 have an arbitrary file read vulnerability due to symlink following in input configuration file handling, including `--files-from`, `--password-file`, and filter merge files. Attackers can read files accessible to the rsync daemon. Upgrading to version 3.5.0 or later is strongly recommended.
Azərbaycanca: rsync 3.5.0 versiyasından əvvəlki versiyalarda simvolik keçid izləmə (symlink following) zəifliyi aşkar edilib. Bu zəiflik `--files-from`, `--password-file` və filter merge faylları kimi giriş konfiqurasiya fayllarının işlənməsi zamanı hücumçuya rsync prosesinin oxuya bildiyi faylları oxumağa imkan verir. dərhal rsync-i 3.5.0 və ya daha yeni versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which versions of rsync are affected by the symlink following vulnerability?
This vulnerability affects all versions of rsync prior to 3.5.0.
What action is recommended to protect against this vulnerability?
Upgrading rsync to version 3.5.0 or later is strongly recommended.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.