CVE-2026-53795

Executive Summary

CVE-2026-53795 is an arbitrary file write vulnerability in rsync versions prior to 3.5.0 that allows attackers to write files outside the intended destination tree by leveraging the --temp-dir or --link-dest options with absolute paths. The flaw bypasses rsync's rename-confinement logic, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process. Any organization using rsync for automated backups, file synchronization, or content distribution with versions before 3.5.0 is affected, and the vulnerability carries a high severity score of 8.1 due to potential full file system corruption on the target host.

Technical Analysis

The vulnerability resides in rsync's handling of two specific command-line options: --temp-dir and --link-dest. Both options accept path arguments that determine where temporary files are placed or where hard-link destinations are resolved during file synchronization operations. Under normal operation, rsync employs a rename-confinement mechanism designed to ensure that file writes remain within the intended destination directory tree. This mechanism validates that temporary file placement and final rename operations do not escape the configured target directory.

The bypass occurs because the rename-confinement logic fails to account for scenarios where --temp-dir or --link-dest resolve to an absolute path outside the destination tree. When an attacker can control or influence these option values — for instance through a malicious rsync daemon configuration, a compromised module definition, or a client-supplied option in an automated synchronization script — the confinement check is not applied consistently. The result is that files can be written to any location on the filesystem that is accessible to the user account running the rsync process, including system directories, configuration files, or other users' home directories.

The vulnerability class is CWE-59 (Improper Link Resolution Before File Access), which describes weaknesses involving symbolic link following and improper resolution of file paths before performing file operations. In this case, the absolute path resolution in --temp-dir and --link-dest effectively bypasses the intended path containment, leading to arbitrary file write capabilities. The attack does not require network-level exploitation of rsync itself — any rsync invocation that passes untrusted values to these options is vulnerable. The network vector in the CVSS scoring indicates this can be triggered remotely when rsync operates as a daemon, where remote clients can potentially influence sync parameters.

Exploitation Scenarios

Based strictly on the vulnerability description, the following attack chain can be derived:

1. Reconnaissance and Target Identification: An attacker first identifies targets running rsync versions prior to 3.5.0. This can be accomplished through banner grabbing on TCP ports 873 (default rsync daemon port) or SSH (typically port 22) where rsync is used over SSH. Version disclosure may occur through rsync daemon module listings or through SSH banner versions when rsync is invoked via SSH. Network scanning tools can fingerprint rsync daemon banners to enumerate vulnerable versions.

2. Flaw Trigger: The attacker crafts a malicious rsync configuration or synchronization request that specifies an absolute path in the --temp-dir or --link-dest option values. If the target is an rsync daemon, the attacker may exploit a misconfigured module definition or leverage anonymous access to a module that allows option injection. If rsync is used over SSH in automated scripts, the attacker may need to compromise a legitimate client or intercept and modify sync parameters. The absolute path supplied points outside the intended destination tree — for example, /etc/cron.d/ or /etc/ld.so.conf.d/.

3. Payload Execution: At the vulnerability-class level, the attacker causes rsync to write attacker-controlled file content to the attacker-specified absolute path. Since the rename-confinement logic is bypassed, the file write operation succeeds in writing to the arbitrary location. No exploit code or PoC is currently confirmed public, so specific payload mechanics cannot be detailed — the attack chain is inferred from the vulnerability class and the option semantics described in the NVD entry.

4. Post-Exploitation Impact: Successful exploitation results in arbitrary file writes on the target system, with permissions limited to those of the user running the rsync process. If rsync runs with elevated privileges (common in backup scenarios), the attacker can overwrite system configuration files such as cron jobs, PAM configuration, service unit files, or sshd configuration. This can lead to complete system compromise through persistence mechanisms, privilege escalation, or denial of service. Even with unprivileged rsync execution, the attacker could corrupt application data, overwrite user configuration files, or cause availability impacts by destroying critical data files.

No public PoC is available; the attack chain is inferred from vulnerability class and the CVSS vector indicating network exploitability with low attack complexity.

Impact Assessment

The CVSS v3.1 score of 8.1 (High) is derived from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The key indicators:

• Attack Vector: Network (AV:N) — Exploitable over the network, indicating rsync daemon deployments are remotely reachable.
• Attack Complexity: Low (AC:L) — No unusual conditions required beyond the vulnerable options being used.
• Privileges Required: None (PR:N) — No pre-existing privileges needed to trigger the vulnerability.
• User Interaction: Required (UI:R) — A user must be tricked into running rsync with attacker-controlled option values, or a client must initiate a sync against a malicious daemon configuration.
• Confidentiality Impact: None (C:N) — The vulnerability does not directly lead to data disclosure.
• Integrity Impact: High (I:H) — Arbitrary file writes allow full compromise of file system integrity on the target.
• Availability Impact: High (A:H) — Overwriting critical system files or data directories can cause complete service outages.

The blast radius is significant. Rsync is ubiquitous in enterprise environments for backup automation, mirror synchronization, content deployment, and log aggregation. Systems running rsync with cron-driven backups, CI/CD pipelines, or automated replication jobs are the most exposed. In daemon mode, multiple internal hosts may connect and synchronize against a single rsync server, meaning a single vulnerable server can present a large attack surface. The high integrity and availability impacts indicate that a successful attack can corrupt critical infrastructure data and render systems inoperable — scenarios that would likely require full system rebuild or restoration from offline backups.

Detection Guidance

Detecting exploitation of this vulnerability requires monitoring for anomalous rsync option usage and unauthorized file writes to sensitive directories. Below are detection rules across multiple SIEM and IDS platforms.

Sigma Rule

title: Suspicious Rsync Temp Directory or Link Destination Usage
id: 08c9a3c5-4b6d-4e7a-9f1e-2d3b5a7c9e1f
status: experimental
description: Detects rsync invocations where --temp-dir or --link-dest specify absolute paths outside typical temporary or destination directories, potentially indicating CVE-2026-53795 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53795
author: Valtersit Threat Intelligence
date: 2026/05/15
tags:
    - attack.t1562.001
    - attack.t1211
    - cve.2026.53795
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/rsync'
        CommandLine|contains:
            - '--temp-dir=/'
            - '--link-dest=/'
            - '--temp-dir=//'
            - '--link-dest=//'
    filter_known_good:
        CommandLine|contains:
            - '--temp-dir=/tmp'
            - '--temp-dir=/var/tmp'
            - '--link-dest=/backup'
    condition: selection and not filter_known_good
level: high
falsepositives:
    - Legitimate backup scripts using explicit absolute paths to staging directories
    - Admin-configured sync jobs referencing remote mount points

YARA Rule

rule CVE_2026_53795_rsync_abs_path_options
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects rsync command lines abusing --temp-dir or --link-dest with absolute paths for arbitrary file write"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-53795"
        date = "2026-05-15"
        cve = "CVE-2026-53795"
        severity = "high"
    strings:
        $opt1 = "--temp-dir"
        $opt2 = "--link-dest"
        $abs1 = /--(?:temp-dir|link-dest)=(\/|\.\.\/|\/[A-Za-z0-9_]+\/\.\.)/
        $abs2 = /--(?:temp-dir|link-dest)=\/(?:etc|bin|sbin|usr|root|home|var|boot|dev|proc|run|opt|srv|mnt|media)/
        $shell_rsync = /rsync\s+.*--(?:temp-dir|link-dest)=/ nocase
    condition:
        uint16(0) == 0x7f5a and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-53795 Rsync Arbitrary File Write - Suspicious Option Usage"; flow:established,to_server; content:"rsync"; nocase; content:"--temp-dir"; nocase; distance:0; content:"/"; http_uri; pcre:"/--(?:temp-dir|link-dest)=[^&\s]*(?:etc|bin|usr|root|var|boot|dev|home)\//i"; sid:202653795; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE_2026_53795, severity high; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-53795; classtype:attempted-admin;)

alert tcp any any -> any 873 (msg:"CVE-2026-53795 Rsync Daemon Offsite Path Write Attempt"; flow:to_server,established; content:"--temp-dir"; nocase; content:"--link-dest"; nocase; content:"/etc/"; nocase; content:"/root/"; nocase; content:"/home/"; nocase; content:"/var/"; nocase; pcre:"/(?:--temp-dir|--link-dest)=($|\s)/"; sid:202653796; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE_2026_53795, severity high; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-53795; classtype:attempted-admin;)

Elastic Detection

// EQL query for Elastic Security
sequence by host.name, process.entity_id with maxspan=5s
  [process where event.type == "start" and 
     process.name == "rsync" and
     process.command_line : ("*--temp-dir=/*", "*--link-dest=/*")]
  [file where event.type == "creation" and 
     file.path : ("/etc/*", "/root/*", "/home/*", "/var/spool/*", "/usr/lib/*", "/usr/local/*", "/bin/*", "/sbin/*")]

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=process_creation
| where process_name="rsync" 
  AND (process_command LIKE "%--temp-dir=/%" OR process_command LIKE "%--link-dest=/%")
  AND NOT (process_command LIKE "%--temp-dir=/tmp%" OR process_command LIKE "%--link-dest=/backup%")
| table _time, host, user, process_command
| eval suspicious=if(match(process_command, "(?i)(etc|bin|sbin|usr|root|home|var|boot|dev|proc|run|opt)" ), "CRITICAL", "REVIEW")
| search suspicious="CRITICAL"
| stats count by host, user, suspicious

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100537" level="12">
    <if_sid>5710</if_sid>
    <field name="command_line">\.?(--temp-dir=/|--link-dest=/).*\.!(/tmp|/var/tmp|/backup)</field>
    <description>CVE-2026-53795: Rsync invoked with absolute --temp-dir or --link-dest outside known safe directories</description>
    <group>syslog, attack, high_severity,</group>
    <mitre>
      <id>T1562.001</id>
    </mitre>
  </rule>

  <rule id="100538" level="14">
    <if_sid>100537</if_sid>
    <field name="command_line">(etc|bin|sbin|usr|root|var|boot|dev|proc|run|opt)[/ ]</field>
    <description>CVE-2026-53795 CRITICAL: Rsync write target resolves to critical system directory</description>
    <group>syslog, attack, high_severity,</group>
  </rule>

  <rule id="100539" level="10">
    <if_sid>5710</if_sid>
    <field name="process">rsync</field>
    <field name="srcip">!127.0.0.1</field>
    <description>CVE-2026-53795: Unusual rsync operation from remote source with option flags</description>
    <group>syslog, attack, medium_severity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch is available from any tracked source at this time. The fixed version is indicated as rsync 3.5.0 (per the NVD description), but this release has not been observed as publicly available.

Immediate Mitigations:

1. Do not accept untrusted --temp-dir or --link-dest values. Audit all automated rsync scripts, cron jobs, and CI/CD pipelines to ensure these options are only passed with hard-coded, trusted paths.
2. Restrict rsync network exposure. If rsync daemon is not strictly required, disable it and use rsync over SSH only with restricted command wrappers.
3. Run rsync with least privilege. Ensure rsync processes run as dedicated unprivileged service accounts, not as root or with broad write permissions.
4. Use filesystem-level write restrictions. Deploy mandatory access control (SELinux/AppArmor) policies to constrain rsync-accessible paths.
5. Monitor for anomalous rsync behavior using the detection rules provided above.

Patch/Upgrade Steps:

1. Monitor the rsync official channels (rsync.samba.org and GitHub repository) for the 3.5.0 release.
2. Upon availability, upgrade to rsync 3.5.0 or later across all affected systems.
3. Until the patch is available, consider replacing rsync with an alternative synchronization tool (e.g., rdiff-backup, rclone) for untrusted synchronization scenarios.

Long-Term Hardening:

1. Establish a vulnerability management process that includes inventorying rsync versions across enterprise systems.
2. Implement network segmentation so rsync daemon services are not reachable from untrusted network segments.
3. Deploy and maintain centralized logging of process executions with full command-line arguments for forensic capability.
4. Subscribe to rsync security announcements and update processes to accelerate patch deployment once available.

References

1. NVD Entry for CVE-2026-53795: https://nvd.nist.gov/vuln/detail/CVE-2026-53795
2. rsync Official Website: https://rsync.samba.org/
3. rsync GitHub Repository (release monitoring): https://github.com/WayneD/rsync
4. CWE-59 (Improper Link Resolution Before File Access): https://cwe.mitre.org/data/definitions/59.html
5. CVSS Calculator Reference: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Threat Actor Campaigns: No confirmed threat actor campaigns or exploit-in-the-wild evidence has been reported at this time. CISA has not added this CVE to the Known Exploited Vulnerabilities Catalog. PoC status is unknown, and no Nuclei templates or public exploit code have been identified. Monitoring for real-world exploitation should continue as the vulnerability becomes more widely known.