Description

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T15:19:42.403Z",
  "pubdate": "2026-08-13T15:19:42.403Z",
  "executiveSummary": "A path traversal vulnerability exists in rsync before version 3.5.0, arising from improper handling of relative paths containing symlink components when operating in --relative mode. The flaw allows a malicious sender to manipulate the receiver into writing files outside the intended destination directory tree. This exposes the receiving system to arbitrary file write capabilities, potentially allowing an attacker to overwrite critical system files or place malicious binaries on the filesystem.\nThe vulnerability affects rsync versions prior to 3.5.0. Exploitation requires the use of the --relative mode and interaction with a malicious sender, which may occur during standard synchronization tasks between untrusted remote hosts and a receiving client. The risk implication is severe, as arbitrary file writes can escalate to remote code execution or complete system compromise depending on the privileges of the rsync process and the files overwritten.",
  "technicalDetails": "The root cause of the vulnerability resides within the make_path() function of rsync. When processing incoming file transfers in --relative mode, rsync creates intermediate directories as specified by the sender's relative path structure. During this directory creation process, make_path() fails to properly validate that the resulting paths remain strictly contained within the intended destination directory boundary.\nSpecifically, the vulnerable function traverses and follows symbolic links encountered during the construction of intermediate directories. If a malicious sender constructs a relative path containing symlink components that point to locations outside the designated destination tree, make_path() inadvertently follows these symlinks. Consequently, subsequent file write operations are directed outside the sandbox boundary, facilitating arbitrary file writes on the receiver's filesystem.\nThe attack flow begins when a client initiates an rsync synchronization operation with a malicious sender using the --relative mode. The malicious sender crafts a payload containing specially manipulated relative paths incorporating symlinks. As the receiver processes the incoming metadata, the vulnerable make_path() function evaluates the path components, resolves the external symlinks, and creates intermediate directories outside the intended root. The sender then transmits the file payload, which rsync writes directly to the traversal-induced location on the receiver's storage.\nThis vulnerability affects rsync versions before 3.5.0. It requires the vulnerable component make_path() to process paths supplied by an untrusted sender utilizing the --relative mode. Authentication and privilege requirements depend on the rsync deployment configuration, such as whether it runs via an rsync daemon or an SSH tunnel, but the core flaw is triggered during the standard data exchange protocol between the sender and receiver."
}