Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-53789rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
Medium 6.5
In plain English
A medium-severity security flaw in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-daemon | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync-daemon | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-rrsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-rrsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| Alpine:v3.21 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53789 |
| Alpine:v3.22 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53789 |
| Alpine:v3.23 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53789 |
| Alpine:v3.24 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-53789 |
| Debian:12 | rsync | no fix listed | DEBIAN-CVE-2026-53789 |
| Debian:13 | rsync | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-53789 |
| Debian:14 | rsync | 3.5.0+ds1-1 | DEBIAN-CVE-2026-53789 |
| Rocky Linux:10 | rsync | 0:3.5.0-3.el10_2 | RLSA-2026:67463 |
| Rocky Linux:8 | rsync | 0:3.1.3-28.el8_10 | RLSA-2026:74095 |
| Rocky Linux:9 | rsync | 0:3.2.7-1.el9_8 | RLSA-2026:67462 |
| Ubuntu:22.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53789 |
| Ubuntu:24.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53789 |
| Ubuntu:26.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-53789 |
| Ubuntu:26.10 | rsync | no fix listed | UBUNTU-CVE-2026-53789 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 0 – through 3.4.4 |
Weakness: CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-fxwg-7hmf-xh5q) vendor-advisory
- rsync 3.5.0 Release Notes release-notes
- https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list third-party-advisory