CVE-2026-70460 RsyncProject CVE debrief

Who should care

System administrators and security teams responsible for rsync installations should assess exposure and prioritize updates to prevent potential arbitrary file writes. This includes reviewing and mitigating existing exposures, monitoring for potential exploitation attempts, and verifying rsync version and exposure to potential exploitation.

Why it matters

CVE-2026-70460 is a critical path traversal vulnerability in rsync that allows for arbitrary file writes. System administrators and security teams should assess exposure, prioritize updates, and monitor for potential exploitation attempts.

• Potential for arbitrary file writes outside the intended module root
• Possible exploitation by attackers with write access to place a symlink under the module root
• Need for verification of rsync version and exposure to potential exploitation
• Priority on updating rsync to version 3.5.0 or later

Technical summary

The vulnerability exists in rsync versions before 3.5.0 and allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. This can lead to arbitrary file writes relative to the module root parent. The vulnerability has a CVSS score of 9.2 and is considered CRITICAL. System administrators and security teams should assess exposure and prioritize updates to prevent potential arbitrary file writes. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references.

Defensive priority

High priority should be given to updating rsync to version 3.5.0 or later, as well as reviewing and mitigating any existing exposures.

Recommended defensive actions

• Update rsync to version 3.5.0 or later
• Review and mitigate existing exposures
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references. Evidence is limited to public CVE and NVD data. Defenders should verify rsync version and exposure to potential exploitation, review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.