CVE-Katalog
CVE-2026-53790
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, includin
- Schweregrad
- Critical · CVSS 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.63% · Oct 23, 2026
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rsync | sid | 3.5.1+ds1-2 | fixed |
| Debian | rsync | forky | 3.5.1+ds1-2 | fixed |
| Debian | rsync | trixie | 3.4.1+ds1-5+deb13u4 | vulnerable |
| Debian | rsync | trixie-security | 3.5.0+ds1-0+deb13u1 | fixed |
| Debian | rsync | bookworm | 3.2.7-1+deb12u6 | vulnerable |
| Debian | rsync | bookworm-security | 3.2.7-1+deb12u5 | vulnerable |
| Alpine | rsync | 3.21 | 3.5.0-r0 | fixed |
| Alpine | rsync | 3.22 | 3.5.0-r0 | fixed |
| Alpine | rsync | 3.23 | 3.5.0-r0 | fixed |
| Alpine | rsync | 3.24 | 3.5.0-r0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rsync | source | sid | 3.5.0+ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | forky | 3.5.0+ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | trixie | 3.5.0+ds1-0+deb13u1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Alpine | rsync | apk | 3.21 | 3.5.0-r0 | Not reported | ALPINE-CVE-2026-53790 | Not reported |
| Alpine | rsync | apk | 3.22 | 3.5.0-r0 | Not reported | ALPINE-CVE-2026-53790 | Not reported |
| Alpine | rsync | apk | 3.23 | 3.5.0-r0 | Not reported | ALPINE-CVE-2026-53790 | Not reported |
| Alpine | rsync | apk | 3.24 | 3.5.0-r0 | Not reported | ALPINE-CVE-2026-53790 | Not reported |
OpenFactory catalog packages
Die Paketzuordnung läuft.
[Debian 12 (Bookworm)]
- [rsync]Unbekannt
Details (4)
3.2.7-1+deb12u6· amd64 · bookwormBetroffen
nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u6· arm64 · bookwormBetroffen
nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u5· amd64 · bookworm-securityBetroffen
nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u5· arm64 · bookworm-securityBetroffen
nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
[Debian 13 (Trixie)]
- [rsync]Unbekannt
Details (5)
3.4.1+ds1-5+deb13u4· amd64 · trixieBetroffen · Behoben:
3.5.0+ds1-0+deb13u1nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u4· arm64 · trixieBetroffen · Behoben:
3.5.0+ds1-0+deb13u1nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u3· amd64 · trixie-security · Historical versionBetroffen · Behoben:
3.5.0+ds1-0+deb13u1nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u3· arm64 · trixie-securityBetroffen · Behoben:
3.5.0+ds1-0+deb13u1nvd · rsync · debian · 13
3.5.0+ds1-0+deb13u1· amd64 · trixie-securityBehoben · Behoben:
3.5.0+ds1-0+deb13u1nvd · rsync · debian · 13
Beobachtet:
Referenzen
- [https://access.redhat.com/errata/RHSA-2026:67462]
- [https://ftp.suse.com/pub/projects/security/]
- [https://github.com/RsyncProject/rsync/releases/tag/v3.5.0]
- [https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-53790]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-53790]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-53790]
- [https://security-tracker.debian.org/tracker/CVE-2026-53790]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2817.json]
- [https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]