Detections
Analytics

Echo: rsync: security update to 3.5.0

high Tenable Self-Hosted Container Security Plugin ID 459816

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files
 accessible to the rsync daemon process by exploiting symlink following in input configuration file
 handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at
 a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon
 module root, to read arbitrary files accessible to the rsync process. (CVE-2026-53802)

Solution

Update the rsync library and its related packages to version 3.5.0 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-53802

Plugin Details

Severity: High

ID: 459816

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.52

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-53802

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.4

Threat Score: 5.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/13/2026

Vulnerability Publication Date: 8/13/2026

Reference Information

CVE: CVE-2026-53802

IAVA: 2026-A-0906