Description

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T15:19:59.957Z",
  "pubdate": "2026-08-13T15:19:59.957Z",
  "executiveSummary": "A path traversal vulnerability exists in rsync versions 2.3.3 prior to 3.5.0, arising from improper handling of symbolic links during file transfer operations.\nThe vulnerability allows a malicious sender to escape the designated module root directory by exploiting symlinks present within the module file tree when utilizing the --partial-dir or --backup-dir options.\nSuccessful exploitation enables attackers with write access to place a symlink under the module root, or leverage pre-existing trusted symlinks, to direct file writes to locations outside the intended module root.\nThe primary impact of this flaw is arbitrary file write relative to the module root parent, potentially leading to unauthorized system modification or data corruption.\nExploitation requires the attacker to possess write access to place a symlink under the module root or to exploit a pre-existing trusted symlink, combined with the use of specific rsync command-line options such as --partial-dir or --backup-dir.",
  "technicalDetails": "The root cause of the vulnerability lies in how rsync resolves and handles symbolic links within the module file tree during specific write operations involving the --partial-dir and --backup-dir parameters.\nWhen a malicious sender interacts with a vulnerable rsync daemon, the software fails to adequately sanitize or restrict destination paths when partial files or backup files are written relative to directories containing symlinks.\nThe attack flow proceeds as follows: First, the attacker establishes write access to place a symbolic link within the module root, or identifies and targets a pre-existing trusted symlink managed within the module file tree.\nSecond, the attacker initiates an rsync transfer using the --partial-dir or --backup-dir options.\nThird, as rsync processes the transfer and attempts to write temporary partial files or backup files, it traverses the controlled symbolic link.\nBecause the path resolution resolves the symlink pointing outside the module root, rsync writes the payload data to locations residing in the module root parent directory.\nThe vulnerable components include the rsync file transfer mechanism and directory restriction logic across affected versions 2.3.3 up to, but not including, 3.5.0.\nThe exploitation allows for arbitrary file write relative to the module root parent, granting the attacker the ability to overwrite or create files outside the restricted security boundaries of the rsync module."
}