Vulnerability Description
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Rsync | < 3.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0ProductRelease Notes
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pqVendor Advisory
- https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-linRelease NotesThird Party Advisory
FAQ
What is CVE-2026-53795?
CVE-2026-53795 is a vulnerability with a CVSS score of 8.1 (HIGH). rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-des...
How severe is CVE-2026-53795?
CVE-2026-53795 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53795?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Rsync.