The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1788959958 advisory.

  - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files     outside the intended module root when use chroot is disabled and the module root path or a component of it     is a symlink. The daemon calls chdir() to the module root at session initialization without resolving     symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files     relative to the symlink target rather than the intended module root, enabling unauthorized file access.
    (CVE-2026-53784)

  - rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files     accessible to the rsync daemon process by exploiting symlink following in input configuration file     handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at     a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon     module root, to read arbitrary files accessible to the rsync process. (CVE-2026-53802)

  - rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite     arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or     daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during     ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege     escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon     configurations. (CVE-2026-53803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1788959958)

high Nessus Plugin ID 359657

Version 1.2