Description

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T15:19:43.030Z",
  "pubdate": "2026-08-13T15:19:43.030Z",
  "executiveSummary": "An improper path handling vulnerability exists in rsync prior to version 3.5.0, allowing a malicious sender to expand the scope of --delete operations beyond the intended destination subtree. The vulnerability stems from the processing of a crafted file list sent from a sender to a receiver. This malicious file list causes the rsync client to incorrectly reclassify implied parent directory entries or treat synthetic paths as the transfer root. Consequently, the flaw impacts data integrity and confidentiality by permitting unauthorized deletions on the receiving system. Affected systems include any deployment of rsync running versions below 3.5.0 that utilizes remote synchronization where the sender cannot be fully trusted. The risk implications are severe, as an attacker with malicious sender capabilities can trigger unintended file deletion outside the authorized destination directory. Exploitation requirements involve a compromised or malicious rsync sender communicating with a receiver that performs file deletions via the --delete option. Attackers leverage multiple variants, including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling, to achieve arbitrary deletion scope expansion.",
  "technicalDetails": "The vulnerability resides in the path handling and file list parsing logic of rsync before version 3.5.0. The root cause is the insecure validation and classification of directory paths received within the file list from a remote sender during synchronization operations. Specifically, when rsync processes incoming path metadata, it fails to adequately restrict the scope of directory trees subjected to deletion routines when the --delete flag is enabled on the receiver.\nExploitation occurs through several distinct variants: implied parent reclassification, synthetic root path construction, legacy protocol behavior operating below protocol version 30, and non-directory root handling. An attacker operating a malicious rsync sender crafts a specialized file list containing manipulated directory and file paths. When the vulnerable receiver parses this payload, the internal path resolution logic incorrectly interprets synthetic paths as the transfer root or reclassifies implied parent directory entries. This logical flaw corrupts the boundary constraints that normally confine file removal operations exclusively to the designated destination subtree.\nThe attack flow proceeds as follows: First, the attacker establishes a synchronization session or coaxes a vulnerable rsync receiver to pull from or push data with a malicious rsync daemon or remote shell source. Second, the malicious sender transmits the crafted file list containing maliciously structured path entries. Third, the receiver processes the file list, resulting in the improper expansion of the transfer root or parent directory reclassification. Fourth, when the receiver executes the deletion phase associated with --delete operations, it evaluates the compromised path boundaries, treating files located outside the authorized destination directory as targets for removal. Finally, the receiver deletes these unauthorized files, leading to data loss and potential system instability depending on the targeted file paths.\nThe vulnerable component is the rsync file list parsing and path resolution subsystem across all versions prior to 3.5.0. Exploitation requires the attacker to control or compromise the sender side of the rsync data transfer. Depending on the configuration, the attack may be executed over standard rsync network protocols or via remote shell integrations without requiring pre-authenticated access on the receiving host, provided the receiver is configured to accept transfers from the malicious source."
}