CVE-2024-12088 Rsync: --safe-links option bypass leads to path traversal
Attackers can bypass safe-links checks to write arbitrary files outside the target directory via malicious symbolic links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-12088?
CVE-2024-12088 is a medium-severity path traversal vulnerability in Gentoo Linux, published on 14 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Weakness: CWE-22
Which versions are affected by CVE-2024-12088?
It affects 20 products.
Linux distribution packages (1)
rsync SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.1.3-3.28.1 |
Products include Almalinux Almalinux, Archlinux Arch Linux, Gentoo Linux, Nixos Nixos, Novell Suse Linux, Redhat Discovery and 14 more.
How do I fix CVE-2024-12088?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-12088 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12088 exists.
Other vulnerabilities in Gentoo Linux
- CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling
- CVE-2024-6387 Openssh: regresshion - race condition in ssh allows rce/dos
- CVE-2024-12085 Rsync: info leak via uninitialized stack contents
- CVE-2024-12087 Rsync: path traversal vulnerability in rsync
- CVE-2024-12086 Rsync: rsync server leaks arbitrary client files
Sources
Also known as ALPINE-CVE-2024-12088, AZL-55658, AZL-55676, BELL-CVE-2024-12088, CLSA-2025-1738632064, CLSA-2025-1750781004 and 7 more.