CVE-2026-53800

Executive Summary

CVE-2026-53800 is a local symlink race condition (CWE-59, TOCTOU) in the rsync file-synchronization tool, affecting all versions prior to 3.5.0. The flaw resides in the --remove-source-files feature, which deletes source files after a successful transfer; an attacker with the ability to create symlinks in the source directory can atomically swap a transferred source file for a symlink, causing rsync to delete an arbitrary file targeted by the symlink instead. With a CVSS score of 4.7 (Medium) and no confirmed in-the-wild exploitation (EPSS 0.00092, absent from CISA KEV), the primary risk is a low-privileged local attacker degrading system or service availability through arbitrary file deletion on multi-user hosts where rsync jobs run with elevated privileges.

Technical Analysis

rsync is one of the most widely deployed file-transfer and synchronization utilities on Linux and Unix-like systems, commonly used in backup pipelines, CI/CD runners, software mirroring, and log-rotation workflows. The --remove-source-files option instructs rsync to unlink each source file after its data has been successfully transferred to the destination. This option is frequently used to implement "move" semantics without copying files back and forth, and it is often present in cron-driven maintenance scripts.

The vulnerability is a classic time-of-check-to-time-of-use (TOCTOU) race condition combined with symlink following, classified under CWE-59 ("Improper Link Resolution Before File Access"). The NVD description outlines the following sequence: after rsync completes the transfer of a source file but before it invokes the unlink() system call on that source path, a window exists in which the directory entry for the source file can be altered. An attacker who has symlink-creation access to the directory containing the source file can atomically substitute a symlink for the intended source file. When rsync's unlink() call then executes against the path, the deletion is applied to the symlink target rather than to the original source file, resulting in arbitrary file deletion.

The attack complexity is rated High (AC:H) in the CVSS vector, which is consistent with the difficulty of reliably winning a TOCTOU race inside the short window between transfer completion and the unlink() syscall. However, the attacker's prerequisites are modest: only low privileges (PR:L) are required to run the attack, and the attacker needs write and symlink-creation access in the directory where rsync's source files reside (e.g., a shared staging directory, a world-writable upload path, or a temporary directory used by a multi-user service). The attacker does not need user interaction (UI:N), and successful exploitation is confined to the local system (AV:L) with an unchanged security scope (S:U).

The attack surface is defined by the deployment context of rsync. The most interesting target is a host where an unprivileged attacker can place files in a directory that is subsequently processed by an rsync job running with higher privileges (e.g., root). In such a configuration, the attacker could cause deletion of any file on the system that the rsync process has permission to delete — configuration files, service binaries, authentication databases, or other users' data. In environments where rsync runs as an unprivileged user, the blast radius is correspondingly limited to files owned by or accessible to that user.

No specific function names, file paths, or configuration details beyond those present in the NVD description are available in the public data provided. The description is sparse on implementation-level detail, so the mechanism must be analyzed at the vulnerability-class level: an atomic directory-entry substitution racing a privilege-bearing unlink() call. The patch confidence is 2/4 (single source, OSV, claims a fix), and the NVD description indicates the fixed version is 3.5.0; this fix has not been independently confirmed, and the OSV package entry is listed as unfixed for the root package.

Exploitation Scenarios

No public PoC or exploit code is currently available, and no Nuclei template exists. The attack chain below is therefore inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance and target identification. The attacker first identifies a host that runs rsync with the --remove-source-files option. Candidates are multi-user systems with shared, group-writable staging directories, content-drops for web publishing, CI build agents, or backup aggregation points. The attacker enumerates scheduled rsync jobs (via process listings, cron inspection, or observation of file-system activity) to locate a source directory in which they possess symlink-creation rights, and to determine the timing of the rsync runs. The chosen victim target file is selected based on the privileges of the rsync process: a root-owned rsync job widens the range of deletable files to the entire host.

2. Triggering the race condition. The attacker waits for the next rsync invocation that processes the shared directory. When a file in the attacker-controlled staging directory is selected by rsync as a source file and begins its transfer, the race window opens. The attacker must monitor the directory to detect when the transfer of the target file completes — for large files the window is more forgiving, but for small files the attacker must be prepared to act within milliseconds, hence the High attack complexity rating.

3. Payload and execution method. At the vulnerability-class level, the attack is a symlink substitution: between rsync finishing the read of the source file and issuing its unlink() call, the attacker atomically replaces the original directory entry with a symlink pointing to the chosen victim file. Because the substitution is atomic (a single rename-type operation), there is no intermediate state in which the path does not exist, and rsync's subsequent unlink() operates on the attacker-selected target rather than the original file, as described in the NVD entry. The attacker may repeat this pattern across multiple files in the same directory run to delete several targets.

4. Post-exploitation impact. The immediate result is unauthorized deletion of one or more arbitrary files with the privileges of the rsync process. Impact ranges from denial of service (removal of critical binaries, configuration files, or application data) to targeted destruction of forensic artifacts or competitor data on shared hosts. In a root-owned rsync context, the attacker could render the system partially or fully inoperable. There are no confidentiality or integrity effects (C:N, I:N in the CVSS vector); the sole impact is on availability (A:H).

Because the race is local and time-bound, exploitation attempts are difficult to observe after the fact: by the time the deletion is noticed, the only artifacts may be an unexpected symlink (which rsync itself may have removed during the unlink()) and the absence of the deleted target.

Impact Assessment

The CVSS v3.1 base score is 4.7 (Medium) with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. The subscores highlight a purely local, difficult-to-execute attack that requires low privileges and yields no confidentiality or integrity compromise, but delivers severe availability damage (A:H) within an unchanged scope.

The primary business impact is denial of service and data destruction. Affected systems are any Unix-like hosts running rsync before 3.5.0 with the --remove-source-files option on directory trees that are writable by more than one user. Typical impacted environments include: shared web-hosting servers with staged content uploads, university or enterprise multi-user HPC clusters, CI/CD agents that pull artifacts from shared workspaces, and backup systems that use rsync to "move" files out of drop directories. In the worst case, a root-scheduled rsync job transforms a low-privileged local user into an agent of host-wide file destruction.

The probability of real-world exploitation is currently low: EPSS scores the CVE at 0.00092 (0.6th percentile of exploited CVEs), the vulnerability is not present on the CISA KEV list, and no public PoC, exploit code, or Nuclei template has been observed. Threat-actor campaigns leveraging this CVE have not been reported. The medium severity rating reflects the fact that exploitation requires local access, a race win, and appropriate directory permissions; nonetheless, the arbitrary-file-deletion primitive is dangerous on shared infrastructure and in root-scheduled automation.

Detection Guidance

The following detection content targets the observability artifacts of this vulnerability. Because the flaw is a local TOCTOU race, network-only detection is of limited value; the rules below therefore focus on the process-level prerequisite (rsync executed with --remove-source-files), on suspicious symlink-creation followed by unlink activity, and on rsync daemon exposure on the network. Analysts should treat these rules as behavioral baselines and tune them to reduce false positives in environments where the option is legitimately used.

Sigma Rule

title: rsync Execution with --remove-source-files (CVE-2026-53800 Surface)
id: 77f3a1c8-3d10-4d50-8b2c-0f9a2c538001
status: experimental
description: >
  Detects execution of the rsync binary with the --remove-source-files
  option, the feature affected by CVE-2026-53800. Presence of this option
  is a prerequisite for the symlink race and arbitrary file deletion.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53800
author: Valters IT Cyber Threat Intelligence
date: 2026/02/01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - rsync
            - rsync.exe
        CommandLine|contains: --remove-source-files
    condition: selection
falsepositives:
    - Legitimate administrative scripts that intentionally implement move semantics
level: medium
tags:
    - attack.impact
    - attack.t1485
    - cve.2026.53800

YARA Rule

rule CVE_2026_53800_rsync_symlink_race_artifacts
{
    meta:
        description = "Detects script and log artifacts referencing rsync --remove-source-files combined with symlink substitution primitives (CVE-2026-53800)"
        author = "Valters IT Cyber Threat Intelligence"
        date = "2026-02-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-53800"
        severity = "medium"
    strings:
        $rsync = "rsync" ascii nocase
        $remove = "--remove-source-files" ascii
        $ln_s = "ln -s" ascii nocase
        $symlink = "symlink" ascii nocase
        $unlink = "unlink" ascii nocase
        $mv_swap = "mv " ascii nocase
    condition:
        $rsync and $remove and 1 of ($ln_s, $symlink, $mv_swap) and #unlink < 3
}

Suricata IDS Rule

alert tcp any any -> any 873 (
    msg:"ET POLICY rsync daemon traffic with remove-source-files option (CVE-2026-53800 exposure)";
    flow:established,to_server;
    content:"@RSYNCD"; nocase;
    content:"remove-source-files"; nocase; distance:0; within:256;
    reference:cve,2026-53800;
    classtype:attempted-dos;
    sid:2026538001;
    rev:1;
    metadata:created_at 2026_02_01, updated_at 2026_02_01;
)

This rule detects rsync protocol negotiation on TCP port 873 in which the client advertises the --remove-source-files option. It is a network-exposure indicator, not a direct detection of the race itself; the local race must be correlated with host-level telemetry.

Elastic Detection

process where process.name == "rsync" and process.args == "--remove-source-files"

The following EQL sequence additionally correlates the creation of a symbolic link in a directory with a subsequent file-deletion event, which corresponds to the observed pattern of an attacker substituting a symlink before rsync's unlink():

sequence by host.name with maxspan=1m
  [ file where event.action == "change" and process.name != "rsync" and file.name : "*.lnk" ]
  [ file where event.action == "deletion" and process.name == "rsync" ]

Splunk SPL Query

index=linux_audit OR index=*unix* sourcetype=linux_audit
| where process_name="rsync" AND process_command_line="*--remove-source-files*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_id, process_command_line
| sort - count

For environments ingesting Sysmon-for-Linux or endpoint process telemetry:

index=endpoint sourcetype="sysmon:linux" OR sourcetype="process_creation"
| search process_name="rsync" AND process_command_line="*--remove-source-files*"
| table _time, host, user, parent_process_name, process_id, process_command_line
| sort - _time

Wazuh OSSEC Rule

Place the following in local_rules.xml:

<group name="cve-2026-53800,">
  <rule id="100538" level="8">
    <match>rsync --remove-source-files</match>
    <description>rsync executed with the --remove-source-files option, exposing CVE-2026-53800 symlink race attack surface</description>
    <group>rsync,doS,</group>
  </rule>

  <rule id="100539" level="10" frequency="5" timeframe="60">
    <if_matched_sid>100538</if_matched_sid>
    <description>Repeated rsync --remove-source-files executions within a short window (possible CVE-2026-53800 race retry attempts)</description>
    <group>rsync,doS,</group>
  </rule>
</group>

Mitigation & Patch Guidance

The patch confidence for this CVE is rated 2/4: a fix is claimed via the OSV source and the NVD description indicates the vulnerability exists in rsync before 3.5.0, but the fix has not been independently confirmed, and the OSV entry lists the root package as unfixed. Treat upgrade guidance as provisional until distribution advisories and the upstream rsync project confirm the release.

1. Immediate mitigations. Wherever possible, discontinue use of the --remove-source-files option on directories that are writable by more than one user. Replace move semantics with a two-step pipeline: run a plain rsync copy, then remove source files with a separate, explicitly enumerated deletion step executed by a privileged script that validates each path. If the option must remain in use, ensure source staging directories are owned by the user running rsync, are mode 0700 or otherwise not writable by untrusted users, and are located outside world-writable paths. Never run rsync jobs with --remove-source-files as root against directories where unprivileged users can create symlinks.

2. Patch and upgrade steps. Upgrade rsync to version 3.5.0 or newer as soon as the release is confirmed by the rsync project and packaged by your operating-system vendor. Before upgrading, verify the vendor advisory and the OSV entry; given the 2/4 patch confidence, compare the claimed fix version (3.5.0) against your distribution's package repository. After upgrading, run a functional regression test on existing rsync-based backup and synchronization scripts.

3. Long-term hardening. Enable Linux audit logging (auditd) on directories used as rsync source staging areas, and alert on the creation of symlinks in those directories followed by unlink or deletion events, using the detection content above. Apply the principle of least privilege to all scheduled rsync jobs — root should only be used when the destination permissions require it. Monitor Shodan-facing rsync daemons (TCP 873) and restrict access to trusted networks. Finally, incorporate this CVE into your vulnerability-scanning baselines and track the EPSS and KEV status over time; although current exploitation probability is very low (EPSS 0.00092), the availability impact justifies prioritization on shared multi-user infrastructure.

References

1. NVD — CVE-2026-53800: https://nvd.nist.gov/vuln/detail/CVE-2026-53800
2. OSV — CVE-2026-53800 entry: https://osv.dev/vulnerability/CVE-2026-53800
3. MITRE — CWE-59 Improper Link Resolution Before File Access: https://cwe.mitre.org/data/definitions/59.html
4. rsync project (upstream) — https://rsync.samba.org/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-53800 not currently listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor campaigns leveraging CVE-2026-53800 have not been observed as of the writing date, and no exploit code is publicly available; the attack chain outlined in this report is inferred from the NVD description and the CWE-59 vulnerability class.