Skip to main content

rsync CVE-2026-70460

| EUVDEUVD-2026-58044 CRITICAL
Path Traversal (CWE-22)
2026-08-13 VulnCheck
Path Traversal Rsync Suse
9.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

Network sender with multiple preconditions (symlink placement plus specific options) gives AC:H; PR:N holds only for anonymously-writable modules; primitive is file write so I:H/A:H and C:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 15:41 vuln.today
Analysis Generated
Aug 13, 2026 - 15:41 vuln.today
CVE Published
Aug 13, 2026 - 14:43 cve.org
CRITICAL 9.2

DescriptionCVE.org

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

AnalysisAI

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symlinks that are followed while resolving the --partial-dir or --backup-dir paths, redirecting writes to the module-root parent and beyond. Any rsync daemon exposing a writable module - or a read/write sync where a sender controls symlinks - is exposed, and the CWE-22 path-traversal primitive can be leveraged to overwrite configuration, cron, or authorized_keys files for follow-on code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Connect to writable rsync module as sender
Delivery
Plant or reuse symlink under module root
Exploit
Transfer with --partial-dir/--backup-dir option
Execution
Follow symlink to escape module root
Persist
Write arbitrary file in parent tree
Impact
Overwrite cron/authorized_keys for code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following concrete conditions: (1) the rsync transfer/daemon module must be operating with the --partial-dir or --backup-dir option in effect; (2) the attacker must act as a malicious sender/peer in the transfer; and (3) the attacker must be able to place a symlink under the module root - which needs write access to a writable module - OR be able to leverage a pre-existing trusted symlink already present in the module tree (no write access needed in that case). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score is 9.2 (VC:H/VI:H/VA:H) with AV:N and PR:N but AC:H, and the high complexity is the key qualifier: exploitation is not a trivial single-shot remote hit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker connects as a sender to a writable rsync daemon module (or is the remote peer in a sync where they control file contents), plants or reuses a symlink under the module root, and initiates a transfer that uses --partial-dir or --backup-dir so that rsync writes files through the symlink to a location outside the module - for example dropping a crontab or authorized_keys file in the parent tree. No public proof-of-concept was identified at time of analysis, and the AC:H rating reflects that the attacker must satisfy the symlink and option preconditions rather than fire a single unconditional request.
Remediation Vendor-released patch: upgrade to rsync 3.5.0 (https://github.com/RsyncProject/rsync/releases/tag/v3.5.0), a release the project explicitly flags as a major security release; distribution rebuilds of 3.5.0 or vendor backports are equally acceptable. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct an inventory of systems running rsync daemons and identify which versions are deployed (affected range: 2.3.3 through 3.4.4) and which modules are configured as writable. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa
CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d
CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv
CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati
CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character
CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_
CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by
CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e
CVE-2026-53791 CRITICAL
9.1 Aug 13

IP-based access control bypass in the rsync daemon (rsyncproject/rsync) before version 3.5.0 lets unauthenticated remote

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Micro 5.3 Affected

Share

CVE-2026-70460 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy