The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rsync-rrsyncUpgrade rsyncUpgrade rsync-daemon | Oct 11, 2026 | Sep 14, 2026 |
| Alpine Linux | — | Upgrade rsync | Sep 1, 2026 | Aug 13, 2026 |
| Amazon_linux_2023 | — | Upgrade rsyncUpgrade rsync-debuginfoUpgrade rsync-debugsourceUpgrade rsync-daemon | Sep 30, 2026 | Aug 13, 2026 |
| Debian | — | Upgrade rsync | Sep 30, 2026 | Aug 13, 2026 |
| Freebsd | — | Upgrade rsync | Aug 27, 2026 | Aug 25, 2026 |
| Oracle_linux | — | Upgrade rsync-daemonUpgrade rsync-rrsyncUpgrade rsync | Oct 22, 2026 | Aug 13, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Oct 1, 2026 | Aug 13, 2026 |
| Redhat_linux | — | No solution existsUpgrade rsync-debugsourceUpgrade rsyncUpgrade rsync-rrsyncUpgrade rsync-daemonUpgrade rsync-debuginfo | Sep 7, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade rsync-debugsourceUpgrade rsync-debuginfoUpgrade rsync | Sep 17, 2026 | Sep 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub