allows you to synchronize files and directories between two machines on a network or between two locations on the same machine
The popular file synchronization tool Rsync has released its highly anticipated version 3.5.0, which comes after several months of continuous development and thorough audits. This update is positioned as one of the most significant in the project's recent history.
The collaborative effort between administrators and the research community has resulted in the correction of dozens of critical security flaws, redefining the way the system handles path resolution, access validations, and symbolic links during transfer operations.
Main news of Rsync 3.5.0
The release of Rsync 3.5.0 addresses direct access and execution control flaws . One of the most serious bugs mitigated is CVE-2026-53791 , a vulnerability in the implementation of the proxy protocol = true mode. Previously, an attacker could establish a direct connection and spoof their IP address by manipulating the PROXY header, thus bypassing the daemon's access restriction rules. With the new update, the system blocks any incoming proxy connection unless an explicit whitelist is defined in the proxy protocol hosts directive.
In parallel, a dangerous command injection vulnerability, identified as CVE-2026-53790, was patched. This flaw occurred because the system did not properly escape external values ​​when invoking commands through environment variables (such as RSYNC_CONNECT_PROG), exec handlers, or the rsync-ssl environment. By receiving unvalidated values ​​such as the hostname or module name, a malicious actor could force the execution of arbitrary commands on the host system.
Protection against symbolic links and out-of-bounds access
Other fixes included in this release address symbolic links, which represented the largest attack vector addressed, totaling eleven vulnerabilities related to this behavior. These flaws allowed a local user with limited privileges to trick the rsync process into reading (CVE-2026-53802) or writing (CVE-2026-53803) arbitrary files outside the designated directory, even bypassing chroot environments. For example, by quickly replacing the target log file with a link to /root/.ssh/authorized_keys, an attacker could insert their credentials into the administrator account.
To eliminate these race-based attacks (TOCTOU), the team unified symbolic link handling across all platforms . Validations are now performed by resolving each path component sequentially and securely, requiring that symbolic links to destination directories belong to the current user or the administrator (root).
Critical vulnerabilities were also patched in rrsync (CVE-2026-53783), which validated a path and then performed synchronization on the same name, opening a window of time that the attacker used to insert a symbolic link that bypassed the allowed base directory.
Memory fixes and resistance to denial-of-service attacks
The update also includes patches for memory corruption vulnerabilities , such as out-of-buffer writes. Developers addressed CVE-2026-70461, where the system ignored the size of the trailing backslash in filtering rules provided by a third party, and CVE-2026-70456, which caused a heap memory failure by ignoring the null character during command argument bound parsing.
The system has also improved its defenses against tactics designed to exhaust server resources ( Denial of Service – DoS ). Critical scenarios, such as those reported under the identifiers CVE-2026-70453 and CVE-2026-70464, where sending incomplete parameters, manipulated strings, or excessive configurations (such as the abusive allocation of Zstandard threads) forced the server's concurrent connection limit or exhausted the CPU's processing capacity, have been resolved, thus stabilizing the Rsync daemon in production environments.
Interested in learning more about this new version? You can find the details at the following link.
How to install Rsync on Linux?
For those who are interested in being able to install this tool on their system, they can do so by installing the package that is offered within the repositories of most Linux distributions.
For those who are users of Debian, Ubuntu or any derivative of these, simply open a terminal and type the following:
sudo apt install rsync
Now, for those who are Fedora users:
sudo dnf install rsync
Whereas for those who are users of Arch Linux and any derivative thereof:
sudo pacman -S rsync
Regarding those who are openSUSE users:
sudo zypper in rsync