Medium severity4.7NVD Advisory· Published Aug 13, 2026

CVE-2026-53800

Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Rsync/Rsyncllm-create
Range: <3.5.0

Patches

Vulnerability mechanics

References

github.com/RsyncProject/rsync/releases/tag/v3.5.0nvd
github.com/RsyncProject/rsync/security/advisories/GHSA-v3vw-pvpg-chwhnvd
www.vulncheck.com/advisories/rsync-symlink-race-condition-via-remove-source-filesnvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000