Description

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-13T15:19:53.020Z",
  "pubdate": "2026-08-13T15:19:53.020Z",
  "executiveSummary": "A symlink following vulnerability exists in rsync before version 3.5.0, enabling local attackers to overwrite arbitrary files.\nThe vulnerability is classified as an insecure file write / symlink following issue affecting the rsync utility.\nImpact includes the unauthorized overwriting of critical filesystem files, potentially leading to local privilege escalation.\nAffected systems include installations running rsync before version 3.5.0, particularly configurations where rsync executes with elevated privileges such as setuid binaries or privileged daemon modes.\nAttacker capabilities require local access to the target system.\nExploitation requirements involve placing a symlink at a predictable output path utilized by ancillary file writing operations, such as --log-file, --write-batch, or daemon-mode log and statistics paths.\nRisk implications are severe on multi-user systems or environments where unprivileged users interact with privileged rsync processes, as successful exploitation can compromise system integrity and grant unauthorized root or administrative execution capabilities.",
  "technicalDetails": "The root cause of the vulnerability stems from rsync's failure to adequately reject symbolic links when performing ancillary file writes.\nThe vulnerable components include output handling mechanisms associated with configuration parameters such as --log-file, --write-batch, and daemon-mode log and statistics paths.\nAffected software versions comprise all rsync releases prior to 3.5.0.\nAuthentication requirements are none at the network level, as the vulnerability is local; however, local user execution is required.\nPrivilege requirements for successful exploitation require the attacker to have local file system access to plant symlinks, while the target rsync process must run with elevated privileges (e.g., setuid or privileged daemon configurations) to achieve privilege escalation.\nNetwork exposure is local, meaning the flaw cannot be directly triggered remotely unless combined with a separate remote vector allowing local file placement and privileged execution, which is outside the core flaw's scope.\nThe attack flow proceeds step-by-step as follows: First, a local attacker identifies a predictable output path utilized by the rsync utility for ancillary file generation, such as destinations specified by --log-file or --write-batch. Second, the attacker places a symbolic link at this predictable output path pointing to a sensitive, arbitrary file on the target filesystem that they normally lack permission to modify. Third, the attacker triggers an rsync operation that runs with elevated privileges (such as a setuid execution or a privileged daemon-mode task) and attempts to write operational logs, statistics, or batch data to the designated output path. Fourth, because rsync fails to validate or reject symbolic links during these ancillary file write operations, the application follows the symlink. Finally, rsync overwrites the targeted arbitrary file with its output data, enabling the attacker to corrupt system files, inject malicious configurations, or achieve local privilege escalation depending on the overwritten file."
}