Description

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T15:19:52.850Z",
  "pubdate": "2026-08-13T15:19:52.850Z",
  "executiveSummary": "An arbitrary file read vulnerability exists in rsync prior to version 3.5.0, arising from insecure symlink following during the processing of input configuration and control files.\nThis security flaw impacts rsync daemon configurations by allowing unauthorized remote actors to read arbitrary files accessible to the rsync daemon process.\nThe primary risk implication is the potential exposure of sensitive system files, application secrets, or configuration data that the daemon process has permissions to access.\nAttacker capabilities include placing predictable symlinks at target paths such as --files-from or --password-file, or supplying a --files-from path designed to escape the designated daemon module root.\nExploitation requirements include the ability to interact with the rsync daemon and manipulate or supply input configuration files or parameters such as --files-from, --password-file, and filter merge files.",
  "technicalDetails": "The vulnerability resides in the input configuration file handling mechanisms of rsync, specifically within components processing --files-from, --password-file, and filter merge files.\nThe root cause stems from improper validation and insecure handling of symbolic links when the rsync daemon parses and follows paths specified in these input control files.\nAffected versions comprise all rsync releases prior to version 3.5.0.\nNetwork exposure involves the rsync daemon service listening for incoming synchronization requests, which can be targeted by remote clients depending on the daemon access configuration.\nAuthentication and privilege requirements depend on the specific rsync daemon configuration; however, the resulting file read is constrained by the underlying system privileges of the rsync daemon process itself.\nThe step-by-step attack flow begins when an attacker identifies or influences the paths utilized by the rsync daemon for operations involving input files.\nThe attacker places a symbolic link at a predictable path expected by the daemon for parameters such as --files-from or --password-file, or alternatively supplies a --files-from path engineered to traverse outside the restricted daemon module root.\nWhen the rsync process attempts to read the specified input configuration or auxiliary files, it resolves and follows the attacker-controlled symbolic link without adequate boundary enforcement.\nThe daemon subsequently reads the contents of the target file referenced by the symlink, which may include sensitive data residing outside the intended module boundaries.\nPost-exploitation impact involves the unauthorized disclosure of arbitrary system files accessible to the rsync process, potentially facilitating further compromise through the leakage of credentials or sensitive configuration parameters."
}