# CVE-2026-53799: rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply…

Source: https://junglewise.ai/threats/cve-2026-53799-rsync-before-3-5-0-contains-a-symlink-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13  
License: CC BY 4.0 with a link back

CVE-2026-53799 · Severity: medium · CVSS 6.3 · Published 2026-08-13

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

Technologies: [Samba Rsync](https://junglewise.ai/threats/technologies/samba-rsync). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-53799 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53799 being exploited in the wild.

**How severe is CVE-2026-53799?** Medium severity, with a CVSS score of 6.3, published 13 August 2026.

**Which products and versions are affected?** Samba Rsync. The advisory does not name versions.

**Is there a fix for CVE-2026-53799?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-53799?** Check whether you run Samba Rsync. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Samba Rsync

## Related threats

- [rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses…](https://junglewise.ai/threats/cve-2026-70463-rsync-3-1-0-before-3-5-0-contains-an-authorization-bypass-in-auth)
- [rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated…](https://junglewise.ai/threats/cve-2026-70461-rsync-3-2-5-before-3-5-0-contains-a-heap-out-of-bounds-write)
- [rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows…](https://junglewise.ai/threats/cve-2026-70459-rsync-3-0-0-before-3-5-0-contains-a-null-pointer-dereference)
- [rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is…](https://junglewise.ai/threats/cve-2026-70457-rsync-3-2-3-before-3-5-0-contains-an-out-of-bounds-write-in-parse)
- [rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system…](https://junglewise.ai/threats/cve-2026-70455-rsync-3-4-2-before-3-5-0-contains-a-denial-of-service)