CVE-2026-53798

Katalog CVE

CVSS 5.3 · Medium EPSS 0,43%

Kerentanan Incorrect Type Conversion or Cast pada samba rsync. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-704: Incorrect Type Conversion or Cast

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-hx7p-3gvv-pqgv advisory vendor
• https://www.vulncheck.com/advisories/rsync-privilege-confusion-via-name-converter-uid-gid-mapping release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes