{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-53801","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-13T15:19:52.623","lastModified":"2026-10-24T16:10:00.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning."},{"lang":"es","value":"rsync anterior a 3.5.0 contiene una vulnerabilidad de condición de carrera de enlace simbólico en la lógica de escaneo de directorios del remitente que permite a los atacantes hacer que el remitente enumere y transfiera archivos fuera del subárbol previsto de la raíz del módulo. Atacantes que pueden crear o manipular enlaces simbólicos en un componente de ruta del árbol escaneado pueden reemplazar un enlace simbólico con una entrada de directorio que apunta fuera de la raíz del módulo entre la llamada a lstat() y la subsiguiente llamada a opendir(), exponiendo archivos más allá de la raíz prevista tanto en el escaneo del lado del remitente en modo demonio como en modo no demonio."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"RsyncProject","product":"rsync","defaultStatus":"unaffected","repo":"https://github.com/RsyncProject/rsync","packageURL":"pkg:github/RsyncProject/rsync","versions":[{"version":"0","lessThanOrEqual":"3.4.4","versionType":"semver","status":"affected"},{"version":"3.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T15:51:53.999454Z","id":"CVE-2026-53801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*","versionEndExcluding":"3.5.0","matchCriteriaId":"6985EC7E-B9D3-4BD6-96F9-43F8322282E7"}]}]}],"references":[{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","source":"disclosure@vulncheck.com","tags":["Product","Release Notes"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm","source":"disclosure@vulncheck.com","tags":["Vendor Advisory"]},{"url":"https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal","source":"disclosure@vulncheck.com","tags":["Release Notes","Third Party Advisory"]}]}}