CVE-2026-53800

脆弱性の種類

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

影響を受ける製品

• samba rsync

参考情報

• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
• https://github.com/RsyncProject/rsync/security/advisories/GHSA-v3vw-pvpg-chwh
• https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-remove-source-files