Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-53785rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
High 7.1
In plain English
A high-severity security flaw in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-daemon | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync-daemon | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-rrsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-rrsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| Alpine:v3.21 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53785 |
| Alpine:v3.22 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53785 |
| Alpine:v3.23 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53785 |
| Alpine:v3.24 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53785 |
| Debian:12 | rsync | no fix listed | DEBIAN-CVE-2026-53785 |
| Debian:13 | rsync | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-53785 |
| Debian:14 | rsync | 3.5.0+ds1-1 | DEBIAN-CVE-2026-53785 |
| Rocky Linux:10 | rsync | 0:3.5.0-3.el10_2 | RLSA-2026:67463 |
| Rocky Linux:8 | rsync | 0:3.1.3-28.el8_10 | RLSA-2026:74095 |
| Rocky Linux:9 | rsync | 0:3.2.7-1.el9_8 | RLSA-2026:67462 |
| Ubuntu:22.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53785 |
| Ubuntu:24.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53785 |
| Ubuntu:26.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53785 |
| Ubuntu:26.10 | rsync | no fix listed | UBUNTU-CVE-2026-53785 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 0 – through 3.4.4 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
References
- GitHub Security Advisory (GHSA-pph3-7xmf-rrqg) vendor-advisory
- rsync 3.5.0 Release Notes release-notes
- https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode third-party-advisory