CVE-2026-70460

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity

This is an Important vulnerability in rsync that allows for path traversal. Exploitation requires a malicious sender to utilize the --partial-dir or --backup-dir options and the ability to create or leverage symlinks within the rsync module's file tree. This could lead to arbitrary file writes outside the intended module root.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the rsyncd daemon if it is unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. Within rsyncd.conf, block the exploit vectors directly by setting refuse options = partial-dir backup-dir and maintain defense-in-depth by enforcing use chroot = yes. Finally, ensure no root- or daemon-owned symlinks point outside your module paths, and avoid using the vulnerable flags when operating as a client against untrusted sources.