CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-53785?
CVE-2026-53785 is a medium-severity vulnerability in RsyncProject rsync, published on 13 Aug 2026.
Official description
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
Weakness: CWE-59
Which versions are affected by CVE-2026-53785?
How do I fix CVE-2026-53785?
Upgrade to a fixed version.
Is CVE-2026-53785 being exploited?
There is no known exploitation of CVE-2026-53785 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-53785, AZL-95813, BELL-CVE-2026-53785, CLSA-2026-1789570375, DEBIAN-CVE-2026-53785, ECHO-eb59-aa32-687f and 2 more.