Description

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T15:19:42.700Z",
  "pubdate": "2026-08-13T15:19:42.700Z",
  "executiveSummary": "An authentication-based filter rule bypass vulnerability exists in rsync before version 3.5.0, involving the handling of filter merge file directives.\nThe vulnerability allows authenticated remote clients to supply malicious --filter merge file directives that override pre-configured daemon module-level filter restrictions.\nSuccessful exploitation enables an attacker to introduce arbitrary filter rules that supersede the intended security boundaries of the daemon module, granting unauthorized read or write access to files and directories that the module filter was explicitly designed to exclude.\nThe risk implication centers on unauthorized file access and potential exposure of sensitive data governed by restrictive module configurations.\nRequired conditions for exploitation include authenticated client access to the rsync daemon and the ability to supply customized command-line filter parameters during the session setup.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure evaluation and precedence handling of client-supplied filter directives within rsync before version 3.5.0.\nSpecifically, the rsync daemon improperly processes client-provided --filter merge file directives, permitting them to take precedence over or incorrectly merge with server-defined module-level filter restrictions.\nThe affected component is the rsync filter evaluation and rule-matching subsystem, which parses and applies inclusion and exclusion patterns during file list generation and transfer operations.\nAttackers authenticated to the rsync service initiate a synchronization request while injecting crafted client-side merge file directives into the protocol stream or command arguments.\nDuring the filter evaluation phase, the daemon processes these injected directives as valid rule sets that supersede the restrictive module-level configuration defined by the administrator.\nThis manipulation subverts the security intent of the module filters, causing the evaluation engine to permit traversal, reading, or writing of paths that should have been blocked.\nPrerequisites for this attack include authenticated access to the vulnerable rsync service and network exposure of the rsync daemon listening port.\nThe post-exploitation impact allows unauthorized retrieval or modification of sensitive files on the host system, circumventing the access control boundary established by the rsync module configuration."
}