CVE-2026-53801

A symlink race condition in rsync's sender directory scanning logic allows a local attacker to bypass intended access restrictions. By replacing a symlink with a directory entry pointing outside the module root during an active scan, the attacker can force rsync to enumerate and transfer unauthorized files, resulting in directory traversal and information disclosure.

A Moderate severity information disclosure vulnerability in rsync's sender-side directory scanning logic allows an attacker to read files outside the intended synchronization root. To exploit this flaw, the attacker must have write access to the rsync source directories in order to create or manipulate symlinks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that rsync source directories have restricted write permissions. Untrusted users should not have the ability to create or manipulate symlinks within the paths scanned by rsync, whether operating in daemon mode or non-daemon sender-side scanning. Implementing strict access controls on these directories can prevent the preconditions necessary for exploitation.