Description

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T15:19:44.117Z",
  "pubdate": "2026-08-13T15:19:44.117Z",
  "executiveSummary": "An arbitrary file write vulnerability exists in rsync before version 3.5.0, allowing malicious actors to write files outside of the intended destination directory tree. This vulnerability affects the rsync utility and carries significant risk implications, as successful exploitation enables an attacker to overwrite or create arbitrary files at locations accessible to the privileges of the executing rsync process.\nThe vulnerability stems from improper handling of absolute paths supplied via specific command-line parameters, specifically bypassing the built-in rename-confinement logic. Attackers with the ability to influence rsync execution options can leverage this flaw to escape the designated destination boundary. No complex authentication mechanisms are inherently required to exploit this behavior if the command arguments are exposed to untrusted input, leading to potential system compromise, configuration tampering, or arbitrary code execution depending on the files overwritten.",
  "technicalDetails": "The vulnerability resides in the core file handling and path sanitization logic of rsync before version 3.5.0, specifically involving the processing of the --temp-dir and --link-dest command-line options. The root cause of the issue is the failure of the rename-confinement mechanism to adequately validate and restrict absolute paths provided through these specific parameters when they resolve to locations outside the intended destination directory tree.\nDuring typical operation, rsync utilizes temporary directories and link destinations to manage file transfers safely before finalizing them in the target location. However, when an attacker specifies an absolute path using the --temp-dir or --link-dest options, the application fails to enforce boundary checks against the designated destination tree. As a result, the rename-confinement logic is bypassed during the final stages of file placement.\nThe attack flow proceeds as follows: First, the attacker supplies a crafted command invoking rsync with malicious absolute paths via --temp-dir or --link-dest pointing outside the intended destination directory. Second, rsync processes the transfer operations, utilizing the attacker-controlled absolute paths for staging or linking temporary files. Third, because the path validation logic fails to intercept the out-of-bounds resolution, rsync bypasses its confinement checks and writes or moves attacker-controlled payload data directly to the arbitrary target location accessible to the process.\nThe affected component is the path resolution and rename-confinement subsystem within rsync versions prior to 3.5.0. Exploitation relies on the ability to supply or influence the command-line flags --temp-dir or --link-dest. The resulting impact allows post-exploitation manipulation of system files, leading to potential privilege escalation, denial of service, or unauthorized modification of critical application data limited only by the file system permissions of the rsync process."
}