CVE-2026-53784

Katalog CVE

CVSS 7.1 · High EPSS 0,24%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada samba rsync. Skor CVSS 3.1 7.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw advisory vendor
• https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes