CVE-2024-12088
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
A flaw in rsync causes the client to improperly verify symbolic link destinations when using the `--safe-links` option, allowing path traversal and arbitrary file write outside the intended directory.
Risk Assessment
The organization risks arbitrary file writes outside the target directory, potentially leading to data integrity breaches or unauthorized access to sensitive resources.
Recommendation
Immediately update rsync to the latest patched version and avoid using the `--safe-links` option in environments where the server may be untrusted.
Original NVD description (English source)
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.