CVE-2026-70460

Name of the Vulnerable Software and Affected Versions rsync versions 2.3.3 through 3.4.x

Description A path traversal issue exists where a malicious sender can escape the module root by exploiting symlinks within the module file tree. This occurs when using the --partial-dir or --backup-dir options. Attackers who can place a symlink under the module root, or leverage an existing trusted symlink, can direct file writes to locations outside the intended module root, resulting in arbitrary file write relative to the module root parent.

Recommendations Update rsync to version 3.5.0 or later. Avoid using the --partial-dir and --backup-dir options until the software is updated.