CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
Засегнати продукти
- RsyncProject rsync: до 3.4.4; 3.5.0
Вид слабост
История
- 13 август 2026 Публикувано
Други уязвимости в RsyncProject rsync
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-53790
- https://nvd.nist.gov/vuln/detail/CVE-2026-53790
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
- https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths