AZL-95774
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95774.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-95774
- Upstream
- Published
- 2026-08-13T15:19:44Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-53795 affecting package rsync for versions less than 3.5.0-1
- Details
-
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.
- References