Link following in Rsync - CVE-2026-70460
Published: August 13, 2026
Vulnerability identifier: #VU142274
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70460
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read files or overwrite, rename, or unlink files outside the module root.
The vulnerability exists due to improper link resolution before file access in the rsync daemon module path resolver when processing peer-supplied --partial-dir or --backup-dir values that resolve through an in-module symlink. A remote attacker can supply a crafted directory value to read files or overwrite, rename, or unlink files outside the module root.
Exploitation requires a trusted in-module symlink owned by uid 0 or the daemon effective uid to already exist along the resolved path, and reach is limited to locations accessible through that symlink by the daemon effective uid.
Affected software
Rsync
How to mitigate CVE-2026-70460
Install security update from vendor's website.
Rsync - update to 3.5.0