CVE-2026-53784: falha de alta gravidade em RsyncProject rsync
rsync < 3.5.0 Path Traversal via Symlink Module Root
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.2%
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
RsyncProject · rsyncCVEs relacionadas — RsyncProject rsync
No mesmo produto, das mais perigosas para as menos.
CVE-2026-43618MEDIUMRsync < 3.4.3 Integer Overflow Information DisclosureEPSS 0.8%CVE-2026-70459MEDIUMrsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List EntryEPSS 0.7%CVE-2026-70464HIGHrsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake StallEPSS 0.6%CVE-2026-53790CRITICALrsync < 3.5.0 Command Injection via Multiple Code PathsEPSS 0.6%CVE-2026-119741HIGHrsync < 3.5.2 Denial of Service via hash_search() Checksum CollisionsEPSS 0.6%CVE-2026-70453HIGHrsync < 3.5.0 Algorithmic Complexity DoS via hash_search()EPSS 0.6%