CVE-2026-53789

Name
CVE-2026-53789
Description
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
disclosure@vulncheck.com https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q
disclosure@vulncheck.com https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* rsync >= None < 3.5.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
rsync edge-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync edge-main 3.4.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.4.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.2.4-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.2.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.2.3-r5 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.2.3-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.2.3-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync edge-main 3.1.2-r7 None possibly vulnerable
rsync 3.24-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.24-main 3.4.3-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.23-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.23-main 3.4.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.23-main 3.4.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.23-main 3.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.23-main 3.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.22-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.22-main 3.4.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.22-main 3.4.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.22-main 3.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.22-main 3.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.22-main 3.4.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.22-main 3.4.0-r0 None possibly vulnerable
rsync 3.22-main 3.2.4-r2 None possibly vulnerable
rsync 3.22-main 3.1.2-r7 None possibly vulnerable
rsync 3.21-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.21-main 3.4.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.4.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.4.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.3.0-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.21-main 3.2.4-r2 None possibly vulnerable
rsync 3.21-main 3.1.2-r7 None possibly vulnerable
rsync 3.20-main 3.4.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.20-main 3.4.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.20-main 3.4.1-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.20-main 3.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.20-main 3.4.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.20-main 3.3.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.20-main 3.2.4-r2 None possibly vulnerable
rsync 3.20-main 3.1.2-r7 None possibly vulnerable
rsync 3.19-main 3.4.1-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.19-main 3.4.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.19-main 3.2.7-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
rsync 3.19-main 3.2.4-r2 None possibly vulnerable
rsync 3.19-main 3.1.2-r7 None possibly vulnerable