CVE-2026-53802

Publié : 13 août 2026

Modifié : 13 août 2026

Score CVSS

7.1

HIGH

Description détaillée

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Références et Patchs

https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4 https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4

Dernières Vulnérabilités

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

VOIR DÉTAILS

CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

VOIR DÉTAILS

CVE-2026-59763

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

VOIR DÉTAILS