CVE-2026-53789

An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a denial of service.

Moderate: This flaw in rsync allows a malicious sender to delete arbitrary files on the receiving system when the --delete option is used. This impact is limited to scenarios where rsync is configured to synchronize data from an untrusted source with deletion enabled, potentially leading to data loss beyond the intended sync target.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the risk of arbitrary file deletion, ensure that rsync operations using the --delete option are only performed with trusted remote sources. If rsync is configured as a daemon (rsyncd), restrict network access to the rsync service (port 873/tcp) to only trusted clients using firewall rules. For example, using firewall-cmd on Red Hat Enterprise Linux: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_ADDRESS>" port port="873" protocol="tcp" accept' firewall-cmd --reload This may impact legitimate rsync operations from untrusted networks. A service reload or restart may be required for changes to take effect.