CVE-2026-53795 rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest

What is CVE-2026-53795?

CVE-2026-53795 is a high-severity path traversal vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.

Weakness: CWE-59

Which versions are affected by CVE-2026-53795?

It affects 1 product.

Products include Samba Rsync.

How do I fix CVE-2026-53795?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-53795 being exploited?

There is no known exploitation of CVE-2026-53795 in the wild and no public exploit code.

Other vulnerabilities in RsyncProject rsync

• CVE-2017-15994 Security feature bypass in n/a Critical 9.8
• CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header Critical 9.1
• CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry High 8.8
• CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion High 8.7
• CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-53795, AZL-95774, BELL-CVE-2026-53795, DEBIAN-CVE-2026-53795, ECHO-3711-8d22-1254, GHSA-m9vj-637x-v6pq and 2 more.