A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-rsyncalma-upgrade-rsync-daemonalma-upgrade-rsync-rrsync | Mar 18, 2025 | Jan 14, 2025 | |
| Alpine Linux | alpine-linux-upgrade-rsync | Aug 8, 2025 | Jan 14, 2025 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-rsyncamazon-linux-ami-2-upgrade-rsync-debuginfo | Jan 15, 2025 | Jan 15, 2025 | |
| Amazon_linux | — | amazon-linux-upgrade-rsync | Jan 18, 2025 | Jan 14, 2025 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-rsyncamazon-linux-2023-upgrade-rsync-daemonamazon-linux-2023-upgrade-rsync-debuginfoamazon-linux-2023-upgrade-rsync-debugsource | Feb 17, 2025 | Jan 14, 2025 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 14, 2025 | |
| Aruba Aos Cx | aruba-aos-cx-cve-2024-12088 | Nov 28, 2025 | Nov 18, 2025 | |
| Debian | debian-upgrade-rsync | Jan 16, 2025 | Jan 14, 2025 | |
| Dell Powerstore Dsa2025223 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | May 27, 2025 | |
| Freebsd | freebsd-upgrade-package-rsync | Jan 16, 2025 | Jan 14, 2025 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-rsync | Jan 16, 2025 | Jan 14, 2025 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-rsync | May 13, 2025 | Jan 14, 2025 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-rsync | Apr 11, 2025 | Jan 14, 2025 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-rsync | May 7, 2025 | Jan 14, 2025 | |
| Huawei Euleros 2_0_sp13 | huawei-euleros-2_0_sp13-upgrade-rsync | Jun 11, 2025 | Jan 14, 2025 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Jul 9, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-rsyncoracle-linux-upgrade-rsync-daemonoracle-linux-upgrade-rsync-rrsync | Mar 12, 2025 | Jan 14, 2025 |
| Redhat_linux | redhat-upgrade-rsyncredhat-upgrade-rsync-daemonredhat-upgrade-rsync-debuginforedhat-upgrade-rsync-debugsourceredhat-upgrade-rsync-rrsync | Mar 12, 2025 | Jan 14, 2025 | |
| Rocky_linux | rocky-upgrade-rsyncrocky-upgrade-rsync-debuginforocky-upgrade-rsync-debugsource | May 8, 2025 | Jan 14, 2025 | |
| Suse | — | suse-upgrade-rsync | Dec 5, 2025 | Mar 13, 2025 |
| Ubuntu | ubuntu-pro-upgrade-rsyncubuntu-upgrade-rsync | Jan 15, 2025 | Jan 14, 2025 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jan 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub