7.2
Élevée
CVE-2026-53799 rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply…
Description
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.
Produits et versions touchés
Autres CVE de rsync
Les 44 CVE de rsync →
CVE-2026-119741
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
8.7
Élevée
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent…
9.1
Critique
CVE-2026-70453
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote…
8.7
Élevée
CVE-2026-70454
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation…
7.6
Élevée