Vulnerability in Rsyncproject Rsync
CVE-2026-53785
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (6.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: -0.000
Affected products
- Rsyncproject Rsync — versions 0, 3.5.0
Weakness classification (CWE)
References
- github.com/RsyncProject/rsync/releases/tag/v3.5.0 (release-notes)
- github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg (vendor-advisory)
- www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode (third-party-advisory)
Frequently asked questions
- What is CVE-2026-53785?
- CVE-2026-53785 is a high-severity vulnerability in Rsyncproject Rsync, classified under Improper Link Resolution Before File Access. CVSS score: 7.1/10. Published 2026-08-13.
- How severe is CVE-2026-53785?
- High severity. CVSS v3 base score is 7.1 out of 10.