CVE-2026-53788CWE-93

CVE-2026-53788

Medium · published August 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00272 · 18.5th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-08-13T19:19Z
References (3)
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 · [email protected]https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4c5-8c68-5fjq · [email protected]https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter-uid-gid-mapping · [email protected]
EPSS history
Timeline
  • 13 AUG 14:36Z
    rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
    cvelistv5