CVE-2026-53800

A Time-of-Check Time-of-Use (TOCTOU) race condition in rsync's --remove-source-files option allows a local attacker to delete arbitrary files. By replacing a source file with a symlink immediately after transfer but before deletion, the attacker can force rsync to delete the symlink target, resulting in data loss or system instability.

An attacker with local access and the ability to create symlinks can exploit a Moderate severity symlink race condition in rsync to delete arbitrary files. This is achieved by altering the symlink target during an active file transfer. Because the flaw stems directly from the --remove-source-files feature, the vulnerability is limited to specific operational scenarios where that option is used.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use --remove-source-files; the unlink path is unused unless that option is enabled. If rsyncd is in use, add remove-source-files to refuse options so clients cannot turn it on. If the option is required, ensure no untrusted user can create or replace directories in the source tree, and do not run rsync as root over such a tree.