CVE-2026-53803

Executive Summary

CVE-2026-53803 is a local symlink following vulnerability affecting rsync versions prior to 3.5.0. The flaw allows local attackers with low privileges to overwrite arbitrary files on the host by leveraging rsync's failure to reject symlinks at predictable ancillary output paths, including --log-file, --write-batch, and daemon-mode log/statistics paths. On installations where rsync operates with elevated privileges—such as setuid binaries or privileged daemon configurations—this vulnerability enables local privilege escalation to root. The vulnerability carries a CVSS score of 7.8 (High) and currently has no known patch, public exploit, or CISA KEV listing.

Technical Analysis

The vulnerability resides in rsync's ancillary file-write operations. When rsync is invoked with certain command-line options or daemon configurations, it writes operational output—logs, batch files, and statistics—to filesystem paths that are either user-controllable or predictable. Specifically, the NVD description identifies three affected output paths:

• --log-file: The user-specified path where rsync writes transfer logs.
• --write-batch: The path used for batch-mode update files.
• Daemon-mode log and statistics paths: Locations configured for logging and transfer statistics in rsync daemon mode.

The core flaw is that rsync fails to reject symlinks at these destination paths during write operations. A local attacker can pre-create a symlink at the exact location where rsync intends to write one of these ancillary files, pointing the symlink to an arbitrary sensitive filesystem location (e.g., /etc/passwd, /etc/cron.d/ entries, SSH authorized_keys files, or other root-owned configuration files). When rsync performs its write operation, it follows the symlink and writes the output data to the redirected target instead of the intended location.

For setuid-root rsync installations, any invocation by an unprivileged user that triggers one of these ancillary writes gives the attacker control over what bytes are written to the target file. Daemon-mode configurations are similarly affected when an unprivileged user can influence daemon-level log or statistics output paths.

The vulnerability class is CWE-59 (Improper Link Resolution Before File Access—"Link Following"), a well-understood TOCTOU-adjacent flaw family that commonly affects tools writing output files to predictable locations without first validating that the path is not a symbolic link. The local attack vector (AV:L), low attack complexity (AC:L), and low privilege requirements (PR:L) make this a straightforward exploitation target on affected systems.

No code-level specifics—function names, internal path validation routines, or specific daemon configuration directives—are available from the NVD description. The description is sufficient to establish the attack mechanism at the class level but does not enumerate affected rsync modules or expose internal implementation details.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: The attacker identifies a target where rsync is installed with elevated privileges. Candidate environments include: multiuser systems with a setuid-root rsync binary, servers running rsync daemon (rsyncd) with logging enabled, and automated backup environments where rsync is invoked via cron or other scheduled jobs using predictable output paths. The attacker checks for predictable configured paths such as system-wide log directories, batch output locations, or daemon statistics file locations.

Step 2 — Flaw Trigger: The attacker creates a symlink at a known/predictable output path. For example, if the target system invokes rsync with --log-file=/var/log/rsync.log (or the attacker can influence an rsync invocation with --log-file=/tmp/rsync.log or another user-writable location), the attacker places a symlink at that path pointing to a sensitive file such as the user's crontab, /etc/passwd, or an /etc/cron.d/ entry. In daemon mode, the log or statistics output path is equally predictable if configuration is static.

Step 3 — Payload/Execution: When rsync executes and performs its write to the symlinked path, the output data is redirected to the attacker-chosen target file. The content written is whatever rsync generates for the ancillary write—log lines, batch metadata, or statistics output. For log files, an attacker can craft a transfer that causes log lines to inject desired content (e.g., cron job entries that trigger command execution). For --write-batch, the batched update data is written to the target, potentially allowing the attacker to plant malicious files at root-owned locations.

Step 4 — Post-Exploitation: Successful file overwrite at an arbitrary location permits local privilege escalation. For example, overwriting a cron configuration file to execute a reverse shell as root, modifying /etc/sudoers to grant the attacker sudo privileges, or replacing a root-executed script with malicious content. Since rsync writes with the privileges of its executing context (setuid root or privileged daemon), the write bypasses typical permission checks. The CVSS confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H).

Note: No public PoC is available; the attack chain above is inferred from the vulnerability class and NVD description. Specific exploitation techniques may vary based on rsync version and system configuration.

Impact Assessment

The business impact of CVE-2026-53803 is concentrated in environments where rsync runs with elevated privileges—the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms a high-severity local privilege escalation. Affected systems include:

• Multiuser Linux/Unix servers with setuid-root rsync binaries.
• Backup infrastructure using rsync daemon mode with logging/statistics enabled.
• CI/CD and automation environments invoking rsync with batch or log output.
• File-synchronization appliances and storage gateways using rsync for replication.

The attack requires local access (AV:L), but given that many rsync deployments also expose daemon mode over networks, an attacker who compromises any low-privileged account on a target can escalate to root. The blast radius for a compromised rsync daemon host is complete system compromise, including exfiltration of sensitive data (C:H), full file integrity loss (I:H), and denial of service via system file corruption (A:H).

Patch confidence is 0/4—no patch evidence exists from any tracked source at the time of writing. This significantly increases the exposure window: affected organizations cannot remediate by patching alone and must implement compensating controls. However, the vulnerability is versioned (rsync before 3.5.0), indicating that a fix is planned for the 3.5.0 release line.

Detection Guidance

The following detection content targets the observable conditions that accompany exploitation: symlink creation at predictable rsync output paths, rsync processes writing to unusual file targets, and anomalous file modifications resulting from symlink redirection.

Sigma Rule

title: Symlink Creation at Predictable Rsync Output Paths
id: 5f9c2a1e-8b3d-4e7a-9c2f-6d1b8e3a7f4c
status: experimental
description: Detects creation of symlinks at paths commonly used by rsync for ancillary file writes (log-file, write-batch, daemon stats/log), which may indicate CVE-2026-53803 exploitation attempts.
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.53803
logsource:
    category: file_event
    product: linux
detection:
    selection:
        EventID: 11  # Sysmon symlink creation
        Image|endswith: ['\ln', '\ln']
        TargetFilename|contains:
            - 'log-file'
            - 'write-batch'
            - 'rsyncd'
            - 'rsync_stats'
            - 'rsync.log'
            - 'batch'
            - 'stats'
    condition: selection
level: high
falsepositives:
    - Legitimate administrative use of symlinks for rsync log rotation
    - Backup scripts creating symlinks intentionally

YARA Rule

rule CVE_2026_53803_Rsync_Symlink_Paths
{
    meta:
        author = "Valters IT Security"
        description = "Detects strings and patterns associated with rsync ancillary file paths exploited in CVE-2026-53803"
        cve = "2026-53803"
        date = "2026-01-01"
    strings:
        $log = "--log-file" ascii nocase
        $batch = "--write-batch" ascii nocase
        $stat = "rsyncstats" ascii nocase
        $daemon_log = "log file" ascii nocase
        $symlink_cmd = "ln -s" ascii nocase
        $rsync_bin = "rsync " ascii nocase
    condition:
        any of ($log, $batch, $stat, $daemon_log) and any of ($symlink_cmd, $rsync_bin)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-53803 — Potential Rsync Daemon Log/Stats Path Spoofing"; flow:to_server,established; content:"|0a 0a|rsync"; nocase; content:"log"; distance:100; nocase; pcre:"/(stats|log|batch)/i"; classtype:attempted-admin; sid:202603801; rev:1; metadata:cve CVE-2026-53803;)

Note: Since this is a local vulnerability, network-based detection is limited to rsync daemon traffic where an attacker might probe configuration or trigger ancillary writes via protocol commands. This rule matches suspicious rsync daemon traffic referencing log/stats/batch paths.

Elastic Detection

// Detect file modification events where the target is a symlink pointing to sensitive system files
file where event.action in ("modification", "change")
  and file.path : ("/etc/passwd", "/etc/sudoers", "/etc/cron.d/*", "/root/*", "/var/spool/cron/*")
  and process.name : "rsync"
  and file.type : "symbolic_link"

Splunk SPL Query

index=syslog OR index=filesystem sourcetype=linux_sysmon OR sourcetype=filesystem_monitor
| search (EventID=11 OR EventCode=12) 
    OR (process_name=rsync AND (file_path="*log-file*" OR file_path="*write-batch*" OR file_path="*rsync*stats*"))
    OR (file_path IN ("/etc/passwd", "/etc/sudoers", "/etc/cron.d/*") AND process_name=rsync)
| stats count by host, user, process_path, file_path
| where count > 0

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100531" level="12">
    <if_sid>510, 550</if_sid>
    <match>rsync</match>
    <description>CVE-2026-53803: rsync process writing to sensitive system files via symlink</description>
    <group>privilege_escalation,</group>
    <mitre><id>T1068</id></mitre>
    <options>no_full_log</options>
  </rule>
  <rule id="100532" level="10">
    <if_sid>100531</if_sid>
    <regex>symlink|log-file|write-batch|log file|stats</regex>
    <description>Potential symlink following exploitation in rsync ancillary output</description>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vendor has indicated a fix is forthcoming in rsync 3.5.0, but no release date or preview patch is available.

1. Immediate Mitigations:

• If rsync is installed setuid-root and no functional requirement mandates this configuration, remove the setuid bit (chmod u-s /usr/bin/rsync). Most environments do not genuinely require setuid root for rsync.
• Restrict rsync daemon log and statistics output paths to directories that are root-owned and not user-writable (e.g., /var/log/rsync/), ensuring they cannot be pre-created as symlinks by unprivileged users.
• Audit any system-wide rsync invocations (cron jobs, systemd timers) for use of --log-file or --write-batch with predictable paths; relocate these outputs to protected directories with restrictive permissions.
• Implement file integrity monitoring (Tripwire, AIDE, OSSEC) on critical system files to detect unexpected modifications.

2. Patch/Upgrade Steps:

• Monitor the official rsync project (rsync.samba.org) and your Linux distribution's security advisory channels for the 3.5.0 release.
• When available, upgrade to rsync 3.5.0 or later immediately, prioritizing setuid and daemon-mode installations.
• Until the patch exists, treat affected systems as vulnerable and apply compensating controls rigorously.

3. Long-Term Hardening:

• Remove setuid-root from rsync binaries permanently; use appropriately scoped sudo rules for users who genuinely require elevated rsync operations.
• Run rsync daemon under a least-privilege service account with restricted filesystem access.
• Deploy SELinux/AppArmor profiles that confine rsync's write operations to expected output directories.
• Implement runtime detection (Sigma/Splunk/Wazuh rules above) to alert on symlink creation at rsync output paths and anomalous writes to sensitive files.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-53803
2. rsync Official Project: https://rsync.samba.org/
3. CWE-59 (Link Following): https://cwe.mitre.org/data/definitions/59.html
4. MITRE ATT&CK T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/

Threat Actor Evidence: No known threat actor campaigns, exploit-in-the-wild activity, or public proof-of-concept code have been identified for CVE-2026-53803 at the time of writing. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. CISA KEV status: NO.