CVE-2026-53800

ADVISORY - nist

Summary

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

EPSS Score⁠: 0.00142 (0.038)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-367⁠

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-59⁠

Improper Link Resolution Before File Access ('Link Following')

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.