CVE-Katalog

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file

[CVE-Katalog]

Schweregrad: High · CVSS 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Aug 12, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.24% · Oct 23, 2026

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rsync	sid	`3.5.1+ds1-2`	fixed
Debian	rsync	forky	`3.5.1+ds1-2`	fixed
Debian	rsync	trixie	`3.4.1+ds1-5+deb13u4`	vulnerable
Debian	rsync	trixie-security	`3.5.0+ds1-0+deb13u1`	fixed
Debian	rsync	bookworm	`3.2.7-1+deb12u6`	vulnerable
Debian	rsync	bookworm-security	`3.2.7-1+deb12u5`	vulnerable
Cpe	rsync	Not reported	`3.5.0`	fixed
Alpine	rsync	3.21	`3.5.0-r0`	fixed
Alpine	rsync	3.22	`3.5.0-r0`	fixed
Alpine	rsync	3.23	`3.5.0-r0`	fixed
Alpine	rsync	3.24	`3.5.0-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rsync	source	sid	`3.5.0+ds1-1`	not yet assigned	Not reported	Not reported
Debian	rsync	source	forky	`3.5.0+ds1-1`	not yet assigned	Not reported	Not reported
Debian	rsync	source	trixie	`3.5.0+ds1-0+deb13u1`	not yet assigned	Not reported	Not reported
Debian	rsync	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Cpe	rsync	cpe	Not reported	`3.5.0`	Not reported	NVD-CVE-2026-53802	Not reported
Alpine	rsync	apk	3.21	`3.5.0-r0`	Not reported	ALPINE-CVE-2026-53802	Not reported
Alpine	rsync	apk	3.22	`3.5.0-r0`	Not reported	ALPINE-CVE-2026-53802	Not reported
Alpine	rsync	apk	3.23	`3.5.0-r0`	Not reported	ALPINE-CVE-2026-53802	Not reported
Alpine	rsync	apk	3.24	`3.5.0-r0`	Not reported	ALPINE-CVE-2026-53802	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[rsync]Betroffen
Details (4)
- 3.2.7-1+deb12u6 · amd64 · bookworm
  Betroffen
  nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
- 3.2.7-1+deb12u6 · arm64 · bookworm
  Betroffen
  nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
- 3.2.7-1+deb12u5 · amd64 · bookworm-security
  Betroffen
  nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
- 3.2.7-1+deb12u5 · arm64 · bookworm-security
  Betroffen
  nvd · rsync · debian · bookworm; nvd · rsync · debian · 12

[Debian 13 (Trixie)]

[rsync]Betroffen
Details (5)
- 3.4.1+ds1-5+deb13u4 · amd64 · trixie
  Betroffen · Behoben: 3.5.0+ds1-0+deb13u1
  nvd · rsync · debian · 13
- 3.4.1+ds1-5+deb13u4 · arm64 · trixie
  Betroffen · Behoben: 3.5.0+ds1-0+deb13u1
  nvd · rsync · debian · 13
- 3.4.1+ds1-5+deb13u3 · amd64 · trixie-security · Historical version
  Betroffen · Behoben: 3.5.0+ds1-0+deb13u1
  nvd · rsync · debian · 13
- 3.4.1+ds1-5+deb13u3 · arm64 · trixie-security
  Betroffen · Behoben: 3.5.0+ds1-0+deb13u1
  nvd · rsync · debian · 13
- 3.5.0+ds1-0+deb13u1 · amd64 · trixie-security
  Behoben · Behoben: 3.5.0+ds1-0+deb13u1
  nvd · rsync · debian · 13

Beobachtet: Oct 24, 2026, 11:06:24 AM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]