CVE-2026-70460

What it is

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-13 15:19 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-24 16:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-13 15:19 UTC

Last modified

2026-10-24 16:10 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-22 · Path traversal

Record status

Undergoing Analysis

Attack profile CVSS 4.0 · 9.2

Attack vector

Network

Complexity

High

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High