rsync v3.5.0 released, fixing 33 vulnerabilites
By SecBurg
rsync is the classic Unix tool for fast, incremental file transfer and synchronization, copying only the parts of files that changed and widely used for backups, mirroring and deployment over SSH or its own daemon protocol.
A new release of rsync just landed, and it’s a heavy one.
v3.5.0 is a major security release, fixing 33 vulnerabilities found during a focused audit of rsync’s path handling and daemon protocol, a companion protocol-fuzzing pass, and reports from external researchers.
Most of the fixes close symlink-following bugs (CWE-59/61): a local user or malicious peer who controls a path component could plant a symlink that a privileged rsync would then follow, leading to arbitrary file read/write, privilege escalation, or escapes from a chroot’d daemon module. Highlights include:
CVE-2026-53802 (HIGH) - arbitrary file read via symlinked filter/password files
CVE-2026-53803 (HIGH) - arbitrary file write / privilege escalation via symlinked log/batch/config paths
CVE-2026-53785 (HIGH) - --relative parent-directory creation followed a planted symlink outside the destination tree
CVE-2026-53784 (HIGH) - daemon module-root chdir escape under "use chroot = no"
CVE-2026-53793 (HIGH) - chroot "/./" inner-module escape via a symlinked parent component
CVE-2026-53795 (HIGH) - absolute --temp-dir / --link-dest disabled the receiver's rename/link confinement
Beyond the symlink fixes, the release also adds a new --confine-root=DIR option, hardens rrsync, masks undefined peer-supplied I/O-error flags, escapes control characters in log-written filenames (CWE-117 log injection), fixes an uninitialized-byte leak in safe_arg(), closes a --safe-links bypass in --backup, and bounds a checksum-matching loop that could otherwise be driven into quadratic CPU usage by a crafted block set. A handful of regular bug fixes and behavior changes round things out, including an AVX2 rolling-checksum buffer over-read, --link-dest no longer failing transfers on filesystems that can’t hard-link special files, and %% handling in --out-format.
The full list of CVEs, credits and technical detail is in the NEWS file. If you’re running rsync anywhere near untrusted input - daemons, backup scripts touching attacker-influenced paths, or CI pipelines - this is not an update to sit on.
Happy updating! :-)