PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53800 RsyncProject CVE debrief

The CVE-2026-53800 vulnerability is classified as a symlink race condition issue within the --remove-source-files feature of rsync versions prior to 3.5.0. This vulnerability allows attackers with symlink creation access to cause arbitrary file deletion. The issue arises when an attacker can atomically substitute a symlink for a source file between the completion of the transfer and the unlink() call, leading rsync to delete the symlink target instead of the intended source file. System administrators and security teams should be aware of this vulnerability, especially in environments where rsync is used with the --remove-source-files feature and where attackers may have symlink creation capabilities. To mitigate this risk, it is recommended to review rsync deployments, verify system configurations, and ensure timely updates to version 3.5.0 or later. Evidence from official CVE Program records and NIST NVD detail pages confirms the existence of this vulnerability. Further verification is recommended by reviewing rsync configurations, monitoring for potential symlink creation attacks, and ensuring systems are updated to version 3.5.0 or later.

Vendor
RsyncProject
Product
rsync
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-13
Original CVE updated
2026-08-26
Advisory published
2026-08-13
Advisory updated
2026-08-26

Who should care

System administrators using rsync with the --remove-source-files feature, security teams monitoring for potential symlink attacks, and operators responsible for maintaining system configurations and updates should be aware of this vulnerability. They should review their rsync deployments, verify system configurations, and ensure timely updates to mitigate potential risks. Vulnerability management and security teams should prioritize monitoring and detection of potential symlink creation attacks in their environments.

Technical summary

The --remove-source-files feature in rsync before 3.5.0 contains a symlink race condition vulnerability. Attackers with symlink creation access can cause arbitrary file deletion by substituting a symlink for a source file between transfer completion and the unlink() call. This vulnerability affects rsync deployments using the --remove-source-files feature, particularly in environments where attackers may have symlink creation capabilities.

Defensive priority

Medium-priority defensive review recommended due to potential symlink race condition vulnerability in rsync.

Recommended defensive actions

  • Review rsync version and upgrade to 3.5.0 or later if vulnerable
  • Verify system configurations for --remove-source-files feature usage
  • Monitor for potential symlink creation attacks
  • Perform vulnerability scanning to identify exposed rsync deployments
  • Implement compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Close the item only after evidence is documented

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates a symlink race condition vulnerability exists in rsync before 3.5.0. Limited source detail available; further verification recommended. To verify, defenders should review rsync configurations, monitor for potential symlink creation attacks, and ensure systems are updated to version 3.5.0 or later.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53800 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53800

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53800 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53800

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.