Description

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-13T15:19:43.690Z",
  "pubdate": "2026-08-13T15:19:43.690Z",
  "executiveSummary": "A path confinement bypass vulnerability exists in rsync prior to version 3.5.0, allowing remote clients to escape the intended inner-module root confinement boundary. The vulnerability arises when a module root contains a /./ boundary marker, leading to improper handling of the /./ notation or forged delta-basis transfers that reference xname paths crossing the boundary. Successful exploitation grants unauthorized remote attackers read or write access to files and directories located outside the module's intended subtree on the underlying filesystem. This flaw impacts system integrity and confidentiality by subverting access controls enforced by rsync module definitions. The attack requires network access to a vulnerable rsync daemon configured with affected module root paths. Remediation requires updating rsync to version 3.5.0 or later where path confinement logic is properly enforced.",
  "technicalDetails": "The vulnerability resides within the path resolution and confinement logic of the rsync daemon, specifically affecting versions prior to 3.5.0. The root cause is the improper handling of path structures when a module root path incorporates a /./ boundary marker. Typically, rsync modules are designed to restrict remote client file access to a specific directory subtree acting as a chroot-like boundary. However, the presence of the /./ notation disrupts normal path normalization and boundary checks.\nAttackers exploit this flaw by constructing specially crafted paths that resolve outside the intended chroot boundary or by forging delta-basis transfers that reference xname paths capable of traversing the /./ boundary marker. When the rsync daemon processes these manipulated paths or delta-basis requests, it fails to adequately validate whether the resulting absolute path resides within the authorized module subtree.\nThe attack flow proceeds as follows: First, the remote client establishes a network connection to the vulnerable rsync daemon. Second, the client initiates a file transfer or query against a module whose root path contains a /./ boundary. Third, the client submits malicious path parameters or crafted delta-basis transfer requests containing xname paths designed to cross the boundary marker. Fourth, the daemon processes the request without proper sanitization, resolving the path outside the confinement zone. Finally, the attacker gains unauthorized read or write access to sensitive files and directories residing on the host system beyond the module's scope.\nThe vulnerable component is the rsync module path confinement and validation subsystem. The vulnerability is network-exploitable by remote clients interacting with the rsync daemon, and exploitation may occur without prior authentication depending on the daemon's access configuration. The post-exploitation impact includes unauthorized data exposure, data tampering, or arbitrary file modification depending on the permissions of the rsync daemon process."
}