CVE-2026-53785 [HIGH] – rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in –relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver’s filesystem.