Module-root escape via symlink in rsync daemon (CVE-2026-70460)

The rsync daemon resolves operator-supplied --partial-dir and --backup-dir option values by following symlinks that are owned by uid 0 or the daemon euid, without verifying that the resolved path remains within the module root. An attacker who can route a peer-supplied directory option through a pre-existing trusted in-module symlink can read files outside the module root (by using them as a delta basis) or overwrite, rename, or unlink them, bounded by what is accessible beneath the trusted symlink to the daemon euid. Exploitation requires a symlink the ownership rule already trusts to exist at a point the peer can route through; the peer cannot plant the symlink themselves. Affected versions: - 2.6.3 through 3.4.4 via --partial-dir - 2.3.3 through 3.4.4 via --backup-dir We recommend updating to: 3.5.0. CVSS 9.2 · our assessment: act_now Reference: https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x Details: https://vuln.today/cve/CVE-2026-70460