Skip to content

GHSA-3jj3-qvc7-jp6x on CTRL-OS 26.05

Aliases: GHSA-3jj3-qvc7-jp6x, CVE-2026-53797

Packages: rsync

Status: Plausible

Advisory Information

A local/non-daemon sender opened each transferred file's content by path (O_NOFOLLOW on the leaf only). A parent component an unprivileged user raced from a real directory to a symlink->outside after the file-list scan was then followed, so a higher-authority sender -- a root nightly backup, or a victim copying an attacker's tree -- read and copied a file from OUTSIDE the source tree into a destination the attacker can read (information disclosure of files the attacker could not otherwise read).

Fix: for default symlink handling, open the content through secure_relative_open(O_RDONLY|O_NOFOLLOW) anchored at the transfer root, so a parent that escaped the tree is refused; the symlink-following modes (-L, --copy-unsafe-links, -k) still follow, and --insecure-links restores the legacy open. The daemon sender was already module_dir-anchored.

Test: symlink-race-source.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”