CVE-2026-53785

High [CVE-2026-53785] Arbitrary file write via path traversal in --relative mode

CVE-2026-53785Source published Aug 13, 2026Source updated Aug 13, 2026

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem. This is an Important vulnerability in rsync where a malicious sender can achieve arbitrary file writes on a receiving system when the `--relative` mode is used. The risk is present in environments where rsync is configured to pull data from untrusted sources with the `--relative` option. Red Hat severity: Important…

Affected products in this advisory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7

3 more entries in the full advisory.

Source-reported affected versions

• < 3.5.0

Source-reported fixed versions

• 3.5.0
• rsync-0:3.5.0-3.el10_2
• rsync-0:3.2.7-1.el9_8
• RHSA-2026:67463

1 more entries in the full advisory.

Mitigation guidance

• To mitigate this issue, avoid using the rsync --relative (-R) option when synchronizing with untrusted senders. Because kernel-level symlink protections cannot prevent rsync from following malicious destination-tree symlinks created by the same executing user, strict sender verification is required. Restricting --relative operations to fully trusted sources prevents attackers from exploiting implied relative paths to achieve path traversal.