High
rsync — security advisory
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
- Products
- rsync
- Affected versions
- 3.0.9-4ubuntu1, 3.1.0-2, 3.1.0-2ubuntu0.1, 3.1.0-2ubuntu0.2, 3.1.0-2ubuntu0.3, 3.1.0-2ubuntu0.4, 3.1.0-2ubuntu0.4+esm1, 3.1.0-2ubuntu0.4+esm2, 3.1.0-2ubuntu0.4+esm3, 3.1.0-2ubuntu0.4+esm4, 3.1.1-3, 3.1.1-3ubuntu1, 3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.1-3ubuntu1.3+esm1, 3.1.1-3ubuntu1.3+esm2, 3.1.1-3ubuntu1.3+esm3, 3.1.1-3ubuntu1.3+esm4, 3.1.1-3ubuntu1.3+esm5, 3.1.1-3ubuntu1.3+esm6, 3.1.2-2, 3.1.2-2.1, 3.1.2-2.1ubuntu1, 3.1.2-2.1ubuntu1.1, 3.1.2-2.1ubuntu1.2, 3.1.2-2.1ubuntu1.3, 3.1.2-2.1ubuntu1.4, 3.1.2-2.1ubuntu1.5, 3.1.2-2.1ubuntu1.6, 3.1.2-2.1ubuntu1.6+esm1, 3.1.2-2.1ubuntu1.6+esm2, 3.1.2-2.1ubuntu1.6+esm3, 3.1.2-2.1ubuntu1.6+esm4, 3.1.3-6, 3.1.3-8, 3.1.3-8ubuntu0.1, 3.1.3-8ubuntu0.2, 3.1.3-8ubuntu0.3, 3.1.3-8ubuntu0.4, 3.1.3-8ubuntu0.5, 3.1.3-8ubuntu0.7, 3.1.3-8ubuntu0.8, 3.1.3-8ubuntu0.9, 3.1.3-8ubuntu0.9+esm1, 3.1.3-8ubuntu0.9+esm2, 3.2.3-4ubuntu1, 3.2.3-4ubuntu2, 3.2.3-8ubuntu1, 3.2.3-8ubuntu2, 3.2.3-8ubuntu3, 3.2.3-8ubuntu3.1, 3.2.7-0ubuntu0.22.04.2, 3.2.7-0ubuntu0.22.04.3, 3.2.7-0ubuntu0.22.04.4, 3.2.7-0ubuntu0.22.04.6, 3.2.7-0ubuntu0.22.04.7, 3.2.7-1, 3.2.7-1build1, 3.2.7-1build2, 3.2.7-1ubuntu1, 3.2.7-1ubuntu1.1, 3.2.7-1ubuntu1.2, 3.2.7-1ubuntu1.4, 3.2.7-1ubuntu1.5, 3.4.1+ds1-5ubuntu1, 3.4.1+ds1-6, 3.4.1+ds1-7, 3.4.1+ds1-7ubuntu0.2, 3.4.1+ds1-7ubuntu0.3, 3.4.4+ds1-1, 3.4.4+ds1-1build1, 3.5.0+ds1-2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-53785
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:29 UTC · Revision 1
Source evidence
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.
osv:UBUNTU-CVE-2026-53785
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
rsync
Fixed versions: Not specified
Complete source record
{
"id": "2b02743280070e83e8200f27439cd97ec6cfadad18343013e831e00debfbe109",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-53785",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-53785",
"summary": "rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.",
"evidence": "osv:UBUNTU-CVE-2026-53785",
"products": [
{
"name": {
"value": "rsync",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.9-4ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.2",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.3",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.4",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.4+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.4+esm2",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.4+esm3",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0-2ubuntu0.4+esm4",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.1-3",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.1",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.2",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3+esm1",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3+esm2",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3+esm3",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3+esm4",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3+esm5",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-3ubuntu1.3+esm6",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.2-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.1",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.2",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.3",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.4",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.5",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.6",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.6+esm1",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.6+esm2",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.6+esm3",
"evidence": "/affected/2/versions"
},
{
"value": "3.1.2-2.1ubuntu1.6+esm4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.3-6",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.3",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.4",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.5",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.7",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.8",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.9",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.9+esm1",
"evidence": "/affected/3/versions"
},
{
"value": "3.1.3-8ubuntu0.9+esm2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.2.3-4ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.3-4ubuntu2",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.3-8ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.3-8ubuntu2",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.3-8ubuntu3",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.3-8ubuntu3.1",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.7-0ubuntu0.22.04.2",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.7-0ubuntu0.22.04.3",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.7-0ubuntu0.22.04.4",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.7-0ubuntu0.22.04.6",
"evidence": "/affected/4/versions"
},
{
"value": "3.2.7-0ubuntu0.22.04.7",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.2.7-1",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1build1",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1build2",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1ubuntu1",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1ubuntu1.1",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1ubuntu1.2",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1ubuntu1.4",
"evidence": "/affected/5/versions"
},
{
"value": "3.2.7-1ubuntu1.5",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.4.1+ds1-7",
"evidence": "/affected/6/versions"
},
{
"value": "3.4.4+ds1-1",
"evidence": "/affected/6/versions"
},
{
"value": "3.4.4+ds1-1build1",
"evidence": "/affected/6/versions"
},
{
"value": "3.5.0+ds1-2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "rsync",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.4.1+ds1-5ubuntu1",
"evidence": "/affected/7/versions"
},
{
"value": "3.4.1+ds1-6",
"evidence": "/affected/7/versions"
},
{
"value": "3.4.1+ds1-7",
"evidence": "/affected/7/versions"
},
{
"value": "3.4.1+ds1-7ubuntu0.2",
"evidence": "/affected/7/versions"
},
{
"value": "3.4.1+ds1-7ubuntu0.3",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-53785",
"aliases": [
"UBUNTU-CVE-2026-53785"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"3.0.9-4ubuntu1",
"3.1.0-2",
"3.1.0-2ubuntu0.1",
"3.1.0-2ubuntu0.2",
"3.1.0-2ubuntu0.3",
"3.1.0-2ubuntu0.4",
"3.1.0-2ubuntu0.4+esm1",
"3.1.0-2ubuntu0.4+esm2",
"3.1.0-2ubuntu0.4+esm3",
"3.1.0-2ubuntu0.4+esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.1.0-2ubuntu0.4+esm4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=esm-infra-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"3.1.1-3",
"3.1.1-3ubuntu1",
"3.1.1-3ubuntu1.1",
"3.1.1-3ubuntu1.2",
"3.1.1-3ubuntu1.3",
"3.1.1-3ubuntu1.3+esm1",
"3.1.1-3ubuntu1.3+esm2",
"3.1.1-3ubuntu1.3+esm3",
"3.1.1-3ubuntu1.3+esm4",
"3.1.1-3ubuntu1.3+esm5",
"3.1.1-3ubuntu1.3+esm6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.1.1-3ubuntu1.3+esm6"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=esm-infra%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"3.1.2-2",
"3.1.2-2.1",
"3.1.2-2.1ubuntu1",
"3.1.2-2.1ubuntu1.1",
"3.1.2-2.1ubuntu1.2",
"3.1.2-2.1ubuntu1.3",
"3.1.2-2.1ubuntu1.4",
"3.1.2-2.1ubuntu1.5",
"3.1.2-2.1ubuntu1.6",
"3.1.2-2.1ubuntu1.6+esm1",
"3.1.2-2.1ubuntu1.6+esm2",
"3.1.2-2.1ubuntu1.6+esm3",
"3.1.2-2.1ubuntu1.6+esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.1.2-2.1ubuntu1.6+esm4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=esm-infra%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"3.1.3-6",
"3.1.3-8",
"3.1.3-8ubuntu0.1",
"3.1.3-8ubuntu0.2",
"3.1.3-8ubuntu0.3",
"3.1.3-8ubuntu0.4",
"3.1.3-8ubuntu0.5",
"3.1.3-8ubuntu0.7",
"3.1.3-8ubuntu0.8",
"3.1.3-8ubuntu0.9",
"3.1.3-8ubuntu0.9+esm1",
"3.1.3-8ubuntu0.9+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.1.3-8ubuntu0.9+esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"3.2.3-4ubuntu1",
"3.2.3-4ubuntu2",
"3.2.3-8ubuntu1",
"3.2.3-8ubuntu2",
"3.2.3-8ubuntu3",
"3.2.3-8ubuntu3.1",
"3.2.7-0ubuntu0.22.04.2",
"3.2.7-0ubuntu0.22.04.3",
"3.2.7-0ubuntu0.22.04.4",
"3.2.7-0ubuntu0.22.04.6",
"3.2.7-0ubuntu0.22.04.7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.2.7-0ubuntu0.22.04.7"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"3.2.7-1",
"3.2.7-1build1",
"3.2.7-1build2",
"3.2.7-1ubuntu1",
"3.2.7-1ubuntu1.1",
"3.2.7-1ubuntu1.2",
"3.2.7-1ubuntu1.4",
"3.2.7-1ubuntu1.5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.2.7-1ubuntu1.5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"3.4.1+ds1-7",
"3.4.4+ds1-1",
"3.4.4+ds1-1build1",
"3.5.0+ds1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.5.0+ds1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:deb/ubuntu/rsync?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"3.4.1+ds1-5ubuntu1",
"3.4.1+ds1-6",
"3.4.1+ds1-7",
"3.4.1+ds1-7ubuntu0.2",
"3.4.1+ds1-7ubuntu0.3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-53785.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rsync",
"binary_version": "3.4.1+ds1-7ubuntu0.3"
}
]
}
}
],
"modified": "2026-10-17T12:58:36.087066116Z",
"provider": "osv",
"upstream": [
"CVE-2026-53785"
],
"references": [
"https://ubuntu.com/security/CVE-2026-53785",
"https://www.cve.org/CVERecord?id=CVE-2026-53785",
"https://download.samba.org/pub/rsync/NEWS#3.5.0"
]
},
"related_cves": [
{
"value": "CVE-2026-53785",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 358843,
"published_at": "2026-08-13T15:19:00+00:00"
}