Skip to content

GHSA-pph3-7xmf-rrqg on CTRL-OS 26.05

Aliases: GHSA-pph3-7xmf-rrqg, CVE-2026-53785

Packages: rsync

Status: Plausible

Advisory Information

Under --relative (-R) the receiver re-creates the implied parent directories of each transferred path via make_path(), which built the parent chain with a plain mkdir() on the full multi-component path. A symlink planted at any parent component was followed, so the new directories (and the file) were created at the symlink's target, outside the destination tree.

Fix: route make_path()'s parent-chain creation through the held-directory-fd creation primitive so each component is confined beneath the destination.

Tests: relative-mkpath-symlink, relative-mkpath-dir-symlink.

Credit: Omar Elsayed (seks99x).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”