CVE-2026-53800

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

EUVD-2026-58038

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

CVE-2026-53800 rsync < 3.5.0 Symlink Race Condition via --remove-source-files

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

CVE-2026-53800

The CVE-2026-53800 issue affects rsync versions before 3.5.0 and concerns a symlink race in the --remove-source-files workflow. An attacker with the ability to create symlinks can time a symlink substitution for a source file between transfer completion and the unlink() call, causing rsync to del...