CVE-2026-70460
Received Received - Intake

Path Traversal in Rsync via Symlink Exploitation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-70460
EUVD
EUVD-2026-58044

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rsync rsync From 2.3.3 (inc) to 3.4.4 (inc)
rsync rsync 3.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in rsync versions 2.3.3 through 3.4.4. It allows a malicious sender to escape the module root directory by exploiting symlinks when using --partial-dir or --backup-dir options. Attackers can place a symlink within the module or exploit existing ones to write files outside the intended directory.

Detection Guidance

Check rsync version with 'rsync --version' to see if it is between 2.3.3 and 3.4.4. Inspect rsync daemon configuration files for use of --partial-dir or --backup-dir options. Monitor for unexpected file writes outside module roots or unusual symlink activity in rsync logs.

Impact Analysis

An attacker could gain unauthorized access to files outside the module root, leading to data theft, modification, or deletion. This could compromise sensitive data or system integrity if the rsync daemon has access to critical files.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if sensitive data is exposed or altered due to the flaw.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable or remove any --partial-dir or --backup-dir options in rsync daemon configurations. Restrict write access to rsync modules to trusted users only. Review and audit symlinks within rsync module directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70460. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart