CVE-2026-53802

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon process, leading to information disclosure.

A symlink-following vulnerability in rsync allows a local, low-privileged attacker to read arbitrary files accessible to the rsync daemon. The issue occurs when rsync improperly handles input configuration files, such as --files-from or --password-file. Exploitation requires a non-default configuration where the attacker can either control the input file paths or plant symlinks within the daemon's module root.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure the rsync daemon runs with the principle of least privilege, enabling use chroot = yes to securely jail the process to its module tree. Restrict write access for daemon configuration directories and files specified by --files-from or --password-file to trusted administrators only. When running rsync outside of daemon mode, ensure users only process input files originating from trusted, non-world-writable directories.