CVE-2026-53786

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Incorrect Authorization pada samba rsync. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6 advisory vendor
• https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes