CVE-2026-53801

The record

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

Affected packages

Related vulnerabilities

• CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
• CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
• CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59
• CVE-2026-105081 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for… CWE-59
• CVE-2026-108119 A flaw was found in busybox. CWE-59
• CVE-2026-12345 The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. CWE-59