Description
rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsync | 2.6.1-1 | — |
| Debian 13 | rsync | 2.6.1-1 | — |
| Debian 12 | rsync | 2.6.1-1 | — |
| Debian 3.0 | rsync | 2.5.5-0.5 | DSA-499 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rsync | 2.5.7-4.3E | RHSA-2004:192 |
Advisories 2
- RHSA-2004:192 Red Hat Security Advisory: rsync security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-499 rsync - directory traversal Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200407-10 vendor-advisory
- oval:org.mitre.oval:def:967 vdb-entry signature
- 11523 third-party-advisory
- 20040521 [OpenPKG-SA-2004.025] OpenPKG Security Advisory (rsync) mailing-list
- rsync-write-files(16014) vdb-entry
- 11688 third-party-advisory
- 11669 third-party-advisory
- O-134 third-party-advisory government-resource
- RHSA-2004:192 vendor-advisory
- 12054 third-party-advisory
- 11514 third-party-advisory
- 11993 third-party-advisory
- http://rsync.samba.org/
- SSA:2004-124-01 vendor-advisory
- MDKSA-2004:042 vendor-advisory
- oval:org.mitre.oval:def:9495 vdb-entry signature
- 11537 third-party-advisory
- DSA-499 vendor-advisory
- 11583 third-party-advisory
- O-212 third-party-advisory government-resource
- 10247 vdb-entry
- TSL-2004-0024 vendor-advisory
- 11515 third-party-advisory