NIXPKGS-2026-2441
GitHub issue
published 9 hours ago
rsync: security issues < 3.5.0 (part 2)
Permalink
CVE-2026-53793
9.1 CRITICAL
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
5 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
13 packages
- librsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- diskrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @pyrox0
- @leona-ya
- @balsoft
- @andir
- @LeSuisse accepted
- @LeSuisse published on GitHub
rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode
-
GitHub Security Advisory (GHSA-wj7w-vh23-mm44) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-70461
8.8 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse ignored package grsync
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
17 packages
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
- @LeSuisse accepted
- @LeSuisse published on GitHub
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
-
GitHub Security Advisory (GHSA-jhxm-j4mq-3fj4) vendor-advisory
Ignored references (2)
-
Release Notes release-notes
-
https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-f… third-party-advisory
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53797
5.7 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
- @LeSuisse accepted
- @LeSuisse published on GitHub
rsync < 3.5.0 Symlink Race Condition Information Disclosure
-
GitHub Security Advisory (GHSA-3jj3-qvc7-jp6x) vendor-advisory
Ignored references (2)
-
Release Notes release-notes
-
https://www.vulncheck.com/advisories/rsync-symlink-race-condition-information-d… third-party-advisory
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53800
5.7 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python313Packages.sysrsync
- @LeSuisse accepted
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @andir
- @leona-ya
- @balsoft
- @pyrox0
-
@LeSuisse
ignored
2 references
- @LeSuisse published on GitHub
rsync < 3.5.0 Symlink Race Condition via --remove-source-files
-
GitHub Security Advisory (GHSA-v3vw-pvpg-chwh) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-symlink-race-condition-via-remove-so… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-70463
8.6 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
- @LeSuisse accepted
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
- @LeSuisse published on GitHub
rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53785
6.9 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- @LeSuisse accepted
-
@LeSuisse
ignored
2 references
- @LeSuisse published on GitHub
rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
-
GitHub Security Advisory (GHSA-pph3-7xmf-rrqg) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-rela… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53790
9.2 CRITICAL
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
- @LeSuisse accepted
-
@LeSuisse
ignored
2 references
- @LeSuisse published on GitHub
rsync < 3.5.0 Command Injection via Multiple Code Paths
-
GitHub Security Advisory (GHSA-5hcf-7xxm-rmqq) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53795
7.2 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): Passive (P)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Passive (P)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- grsync
- rrsync
- rsyncy
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
- @LeSuisse accepted
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @andir
- @balsoft
- @leona-ya
- @pyrox0
- @LeSuisse published on GitHub
rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest
-
GitHub Security Advisory (GHSA-m9vj-637x-v6pq) vendor-advisory
Ignored references (2)
-
Release Notes release-notes
-
https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-li… third-party-advisory
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53788
6.9 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): Low (L)
- Vulnerable System Impact Integrity (VI): Low (L)
- Vulnerable System Impact Availability (VA): None (N)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
- Modified Vulnerable System Impact Integrity (MVI): Low (L)
- Modified Vulnerable System Impact Availability (MVA): None (N)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
11 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
7 packages
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @pyrox0
- @balsoft
- @leona-ya
- @andir
- @LeSuisse accepted
- @LeSuisse published on GitHub
rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
-
GitHub Security Advisory (GHSA-p4c5-8c68-5fjq) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53796
5.8 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
-
@LeSuisse
ignored
2 references
- @LeSuisse accepted
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @pyrox0
- @balsoft
- @andir
- @leona-ya
- @LeSuisse published on GitHub
rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling
-
GitHub Security Advisory (GHSA-w75h-ccff-w53m) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-toctou-race-condition-via-destinatio… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-70459
6.9 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- python314Packages.vdirsyncer
- python313Packages.vdirsyncer
- python314Packages.sysrsync
- python313Packages.sysrsync
- python314Packages.btrsync
- python313Packages.btrsync
- sqlite-rsync
- openrsync
- diskrsync
- parsync
- rsyncy
- rrsync
- grsync
- yaziPlugins.rsync
- vdirsyncer
- lazyrsync
- librsync
- btrsync
- @LeSuisse accepted
-
@LeSuisse
ignored
2 references
- @LeSuisse published on GitHub
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
-
GitHub Security Advisory (GHSA-p4v4-qxw9-q72m) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4
Permalink
CVE-2026-53794
6.9 MEDIUM
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): None (N)
- Vulnerable System Impact Integrity (VI): None (N)
- Vulnerable System Impact Availability (VA): Low (L)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): None (N)
- Modified Vulnerable System Impact Integrity (MVI): None (N)
- Modified Vulnerable System Impact Availability (MVA): Low (L)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
18 packages
- grsync
- rrsync
- rsyncy
- btrsync
- parsync
- librsync
- diskrsync
- lazyrsync
- openrsync
- vdirsyncer
- sqlite-rsync
- yaziPlugins.rsync
- python313Packages.btrsync
- python314Packages.btrsync
- python313Packages.sysrsync
- python314Packages.sysrsync
- python313Packages.vdirsyncer
- python314Packages.vdirsyncer
- @LeSuisse accepted
-
@LeSuisse
ignored
2 references
-
@LeSuisse
ignored
maintainer.ignore
4 maintainers
- @leona-ya
- @pyrox0
- @balsoft
- @andir
- @LeSuisse published on GitHub
rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error
-
GitHub Security Advisory (GHSA-p827-vwcp-m964) vendor-advisory
Ignored references (2)
-
https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-lo… third-party-advisory
-
Release Notes release-notes
rsync
- ==3.5.0
- =<3.4.4