CVE-2026-53795

Katalog CVE

CVSS 8.1 · High EPSS 0,40%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada samba rsync. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq advisory vendor
• https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes