CVE-2026-53785

A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory.

This is an Important vulnerability in rsync where a malicious sender can achieve arbitrary file writes on a receiving system when the --relative mode is used. This path traversal flaw allows symlink components in relative paths to escape the intended destination directory. The risk is present in environments where rsync is configured to pull data from untrusted sources with the --relative option.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using the rsync --relative (-R) option when synchronizing with untrusted senders. Because kernel-level symlink protections cannot prevent rsync from following malicious destination-tree symlinks created by the same executing user, strict sender verification is required. Restricting --relative operations to fully trusted sources prevents attackers from exploiting implied relative paths to achieve path traversal.