Critical Security Vulnerability in rsync: Path Traversal and Arbitrary File Access
Summary
RLSA-2026:67463: Important: rsync security, bug fix, and enhancement update. Affects rsync versions < 0:3.5.0-3.el10_2. Fixed in 0:3.5.0-3.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. It is known for its efficiency, as it only transfers the differences between files rather than the entire files, making it a preferred choice for mirroring and backup tasks. However, recent vulnerabilities have been identified in versions prior to 3.5.0, exposing users to various security risks.
Vulnerability Detail
The vulnerabilities in rsync include a path traversal issue via the --partial-dir and --backup-dir options, which could allow attackers to manipulate file paths and access unauthorized files. Additionally, there are risks of arbitrary file deletion through malicious file lists, command injection vulnerabilities, and memory corruption issues. These vulnerabilities can lead to unauthorized access, data loss, and denial of service, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
0:3.5.0-3.el10_2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the vulnerable options such as --partial-dir and --backup-dir until they can update to the patched version. Additionally, ensuring that file lists are sanitized and not manipulated by untrusted sources can help reduce risk.
Conclusion
The vulnerabilities in rsync present serious security risks that can lead to unauthorized access and data loss. It is crucial for users to update to the latest version to protect their systems. By following the outlined steps to fix the vulnerabilities and considering the provided workarounds, users can enhance their security posture.
See every vulnerability recorded for rsync →
FAQ
Versions of rsync prior to 3.5.0 are affected by multiple vulnerabilities, including path traversal and arbitrary file access.
The vulnerabilities can lead to unauthorized file access, arbitrary file deletion, command injection, and denial of service, posing significant security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
