CVE-2026-53788

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-93

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-537898.1rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operationCVE-2026-53793.0An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. ThCVE-2026-537908.1rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by suCVE-2026-537919.1rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based acceCVE-2026-537926.5rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to CVE-2026-537937.4rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confCVE-2026-537945.3rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allCVE-2026-537958.1rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination treeCVE-2026-537966.3rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination diCVE-2026-537974.7rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manCVE-2026-537985.3rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackersCVE-2026-537996.3rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or ext
CVE-2026-53788: Medium severity, CVSS 6.5 | Vulnix