8.1High
CVE-2026-70460rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
Description
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| RsyncProject | rsync | 2.3.3 – ≤ 3.4.4, fixed 3.5.0 | |
| samba | rsync | 2.3.3 – ≤ 3.4.4 |
References and patches
- GitHub Security Advisory (GHSA-w3xf-j2r2-gv4x) vendor-advisoryVendor Advisory
- rsync 3.5.0 Release Notes release-notesRelease Notes
- https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink third-party-advisoryThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*≥ 2.3.3 < 3.5.0