CLSA-2026-1788960665
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos8.5els/CLSA-2026-1788960665.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788960665
- Upstream
CVE (2)
- Published
- 2026-09-09T13:31:17Z
- Modified
- 2026-10-26T09:31:51Z
- Summary
- rsync: Fix of 2 CVEs
- Details
-
- CVE-2026-53802: arbitrary file read via symlinked operator-supplied input paths because --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/--exclude-from and the --password-file / daemon secrets file were opened by path, letting a planted symlink feed an arbitrary file to the filter parser or the authentication response; these now use the same ownership-checked path walk
- CVE-2026-53803: arbitrary file write via symlinked operator-supplied output paths because --log-file, --write-batch/--read-batch and the daemon motd, lock and --config opens resolved by path, letting a planted symlink redirect a privileged write; these now use the same ownership-checked path walk, and --read-batch additionally requires a regular file or a FIFO
- Note: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.
- References
Affected packages
TuxCare:CentOS:8.5 / rsync
Package
- Name
- rsync
- Purl
- pkg:rpm/tuxcare/rsync?distro=centos-8.5