Path Traversal Vulnerability in Rsync Affected by Symlink Exploitation

CVE-2026-70460

What is CVE-2026-70460?

Rsync versions prior to 3.5.0 are susceptible to a path traversal vulnerability caused by the mishandling of symbolic links within the module file tree. This issue arises when using the --partial-dir or --backup-dir options, allowing an attacker with write permissions to manipulate symlinks under the module root. By exploiting this vulnerability, attackers can redirect file writes to unauthorized locations outside the intended module root, posing a significant security risk. Effective remediation requires updating to a patched version or implementing additional restrictions on symlink manipulation.

References