Description

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T15:19:42.190Z",
  "pubdate": "2026-08-13T15:19:42.190Z",
  "executiveSummary": "A path traversal vulnerability exists in rsync before version 3.5.0, allowing remote clients to access files outside the intended module root.\nThe vulnerability occurs when use chroot is disabled and the module root path or a component of it contains a symbolic link.\nThe impact includes unauthorized file access, potentially leading to the exposure of sensitive system data to remote unauthorized actors.\nAffected systems are rsync daemon deployments running versions prior to 3.5.0 where chroot functionality is explicitly disabled and module paths involve unresolved symlinks.\nRisk implications are high for misconfigured rsync servers, as attackers can bypass logical boundaries established by module root definitions.\nAttacker capabilities involve remote, unauthorized reading of files residing outside the intended directory structure via crafted relative-path operations.\nExploitation requires the rsync daemon to have use chroot disabled and the module root path or its components to be configured as symbolic links without path resolution.",
  "technicalDetails": "The root cause of the vulnerability stems from the rsync daemon initialization sequence where the application calls chdir() to the configured module root without resolving symbolic links via realpath() or an equivalent function.\nWhen use chroot is disabled, the working directory is changed directly to the module root path as provided in the configuration, without canonicalizing the path to resolve any symlinks present in the directory hierarchy.\nThe vulnerable component is the session initialization routine within the rsync daemon responsible for establishing the working directory context for client requests.\nAffected versions include all rsync deployments prior to version 3.5.0.\nAuthentication requirements depend on the specific rsync module configuration, but the flaw can potentially be triggered by remote clients interacting with exposed modules.\nPrivilege requirements are low from an external perspective, as remote unauthenticated or authenticated clients can initiate sessions depending on daemon settings.\nNetwork exposure is inherent to rsync daemon services listening on TCP ports, typically TCP port 873.\nDuring exploitation, the rsync daemon initializes a session and executes chdir() on a module path containing a symlink, causing the process working directory to point to the symlink target rather than the intended module root.\nSubsequent relative-path operations performed by the daemon reference files relative to the actual symlink target directory on the filesystem.\nStep-by-step attack flow involves: first, identifying an rsync daemon running a vulnerable version with use chroot disabled and a symlinked module path; second, issuing standard file transfer or listing requests; third, leveraging relative path traversal constructs or relying on the misresolved working directory; and finally, accessing unauthorized files located outside the intended module boundary."
}