CVE-2026-53799

Katalog CVE

CVSS 6.3 · Medium EPSS 0,12%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada samba rsync. Skor CVSS 3.1 6.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-phxh-hjqv-39c9 advisory vendor
• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-acl-xattr-application release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes