CVE-2026-53795

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption.

This Important flaw in rsync allows an attacker to write files to arbitrary locations outside the intended destination. This occurs when a user is tricked into executing rsync with attacker-controlled absolute paths via the --temp-dir or --link-dest options, bypassing path confinement. The requirement for user interaction to supply malicious input prevents this from being a Critical severity issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not pass untrusted values into --temp-dir or --link-dest. If you need those options, keep the destination (and those dirs) free of writes by untrusted users so a parent cannot be swapped to a symlink. Do not use --partial-dir or --inplace when pulling from an untrusted server. If rsyncd runs with use chroot = no, restrict who can connect.