Arbitrary File Write Vulnerability in rsync

Rsync versions prior to 3.5.0 are vulnerable to an arbitrary file write vulnerability (CVE-2026-53795) caused by improper handling of absolute paths. When an attacker provides absolute paths via the --temp-dir or --link-dest command-line options, the application fails to correctly apply rename-confinement logic. This failure permits the rsync process to write files to locations outside the intended destination directory, provided those locations are writable by the user executing the rsync process. This vulnerability poses a significant risk to systems that process untrusted rsync inputs or automated synchronization tasks, as it could be leveraged to overwrite sensitive configuration files or inject malicious binaries, potentially leading to privilege escalation or system compromise.

Attack Chain

1. Attacker identifies an automated system or user process executing rsync with user-controllable arguments.
2. Attacker crafts a malicious rsync command that includes the --temp-dir or --link-dest options.
3. Attacker specifies an absolute path for these options that targets a directory outside the intended scope.
4. The rsync process initiates, processing the supplied malicious path parameters.
5. The application fails to validate the absolute path against the destination tree restrictions.
6. The rename-confinement check is bypassed due to logic flaws in path resolution.
7. The rsync process writes a file to the attacker-defined absolute path location.
8. The attacker achieves unauthorized file creation or modification on the target system.

Impact

Successful exploitation allows for the unauthorized creation or modification of files anywhere on the local filesystem that the rsync process has permissions to access. This can result in system instability, the injection of malicious scripts into cron jobs, or the overwriting of SSH authorized_keys, ultimately leading to full system compromise or persistence for the attacker.

Recommendation

• Update rsync to version 3.5.0 or later on all systems to remediate CVE-2026-53795.
• Audit scripts and automation pipelines for rsync commands that utilize --temp-dir or --link-dest flags with untrusted input.
• Restrict the permissions of the user accounts executing rsync to the minimum necessary directory access to limit the potential impact of an arbitrary file write.