CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
A malicious sender can exploit symlinks in rsync to write files outside the intended module root, requiring specific command-line options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70460?
CVE-2026-70460 is a critical path traversal vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.
Which versions are affected by CVE-2026-70460?
How do I fix CVE-2026-70460?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-70460 being exploited?
There is no known exploitation of CVE-2026-70460 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-70460, AZL-95828, BELL-CVE-2026-70460, CLSA-2026-1792173472, DEBIAN-CVE-2026-70460, ECHO-d837-aa5e-cf4e and 3 more.