CVE-2026-70460: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
Other sources
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70460?
CVE-2026-70460 has a severity rating of 8.1, classified as high.
How do I fix CVE-2026-70460?
To mitigate CVE-2026-70460, upgrade rsync to version 3.5.0 or later.
What does CVE-2026-70460 affect?
CVE-2026-70460 affects rsync versions 2.3.3 to 3.4.x.
What type of vulnerability is CVE-2026-70460?
CVE-2026-70460 is identified as a path traversal vulnerability.
What are the conditions to exploit CVE-2026-70460?
To exploit CVE-2026-70460, an attacker must have write access to place a symlink under the module root when using the --partial-dir or --backup-dir options.