CVE-2026-53785
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Aug 13, 2026
Vendor
unknown
Description
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.