{"apiVersion":"1.0","identifier":"CVE-2026-53801","description":"rsync before 3.5.0 contains a symlink race condition vulnerability in the sender-s directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root-s intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.","publishedAt":"2026-08-13T15:19:52","lastModifiedAt":"2026-08-26T17:00:56","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53801","cvssScore":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","epssProbability":0.00286,"riskScore":0.61,"affectedProduct":"rsync","affectedVersions":"<3.5.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-53801","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-53801","en":"https://www.redsauce.net/en/cves/CVE-2026-53801","fr":"https://www.redsauce.net/fr/cves/CVE-2026-53801","pt":"https://www.redsauce.net/pt/cves/CVE-2026-53801","de":"https://www.redsauce.net/de/cves/CVE-2026-53801","sk":"https://www.redsauce.net/sk/cves/CVE-2026-53801","el":"https://www.redsauce.net/el/cves/CVE-2026-53801"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-53801"}}