ALPINE-CVE-2026-53801
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.
ALPINE-CVE-2026-53801
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-53801
rsync
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
rsync
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
rsync
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
rsync
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-53801.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-53801.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-53801.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-53801.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #54524 · Revision 1
- Added to Heist Feed
- Publisher date