CVE-2026-53795
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Aug 13, 2026
Vendor
unknown
Description
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.