rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rsync-rrsyncUpgrade rsyncUpgrade rsync-daemon | Oct 11, 2026 | Sep 14, 2026 |
| Alpine Linux | — | Upgrade rsync | Sep 1, 2026 | Aug 13, 2026 |
| Amazon_linux_2023 | — | Upgrade rsync-daemonUpgrade rsyncUpgrade rsync-debugsourceUpgrade rsync-debuginfo | Sep 30, 2026 | Aug 13, 2026 |
| Debian | — | Upgrade rsync | Sep 30, 2026 | Aug 13, 2026 |
| Freebsd | — | Upgrade rsync | Aug 27, 2026 | Aug 25, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Oct 1, 2026 | Aug 13, 2026 |
| Redhat_linux | — | Upgrade rsync-debuginfoNo solution existsUpgrade rsync-debugsourceUpgrade rsync-rrsyncUpgrade rsyncUpgrade rsync-daemon | Aug 21, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade rsync-debugsourceUpgrade rsyncUpgrade rsync-debuginfo | Sep 17, 2026 | Sep 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub