Skip to content

RsyncProject · weakness class

File and Path Handling

13 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

  1. rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir SymlinkCVE-2026-70460RsyncProject · CVSS 8.1 · 0.4% likely

    CWE-22

  2. rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsyncCVE-2026-53783RsyncProject · CVSS 8.1 · 0.4% likely

    CWE-59

  3. rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-destCVE-2026-53795RsyncProject · CVSS 8.1 · 0.4% likely

    CWE-59

  4. rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot ModeCVE-2026-53793RsyncProject · CVSS 7.4 · 0.4% likely

    CWE-59

  5. rsync < 3.5.0 Symlink Race Condition Directory TraversalCVE-2026-53801RsyncProject · CVSS 5.9 · 0.3% likely

    CWE-59

  6. rsync < 3.5.0 Arbitrary File Read via Symlink FollowingCVE-2026-53802RsyncProject · CVSS 7.1 · 0.2% likely

    CWE-61

  7. rsync < 3.5.0 Path Traversal via Symlink Module RootCVE-2026-53784RsyncProject · CVSS 7.1 · 0.2% likely

    CWE-59

  8. rsync < 3.5.0 Path Traversal Write Escape via --relative ModeCVE-2026-53785RsyncProject · CVSS 7.1 · 0.2% likely

    CWE-59

  9. rsync < 3.5.0 Symlink Following Arbitrary File OverwriteCVE-2026-53803RsyncProject · CVSS 7.8 · 0.2% likely

    CWE-59

  10. rsync < 3.5.0 TOCTOU Race Condition via Destination Directory HandlingCVE-2026-53796RsyncProject · CVSS 6.3 · 0.1% likely

    CWE-59

  11. rsync < 3.5.0 Symlink Race Condition Information DisclosureCVE-2026-53797RsyncProject · CVSS 4.7 · 0.1% likely

    CWE-59

  12. rsync < 3.5.0 Symlink Race Condition via --remove-source-filesCVE-2026-53800RsyncProject · CVSS 4.7 · 0.1% likely

    CWE-59

  13. rsync < 3.5.0 Symlink Race Condition via ACL/xattr ApplicationCVE-2026-53799RsyncProject · CVSS 6.3 · 0.1% likely

    CWE-59

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.