CVE-2026-70460

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70460
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70460.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70460
Aliases
  • GHSA-w3xf-j2r2-gv4x
Downstream
ALPINE (1)
ALSA (3)
AZL (1)
BELL (1)
CLSA (3)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (3)
openSUSE (2)
RHSA (3)
RLSA (3)
ROOT (1)
SUSE (6)
UBUNTU (1)
Related
ALSA (3)
openSUSE (2)
SUSE (6)
Published
2026-08-13T14:43:06Z
Modified
2026-11-08T02:47:41Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
Details

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22",
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70460.json"
}
References

Affected packages

Git / git.samba.org/rsync.git/

Affected ranges

Type
GIT
Repo
https://git.samba.org/rsync.git/
Events
Introduced
461c6de1a8f2d6eac44e607c6862f356915e579d
Fixed
471e17dc0d68233db84db11be82c9f62f4661214
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.3.3"
                },
                {
                    "fixed": "3.5.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/rsyncproject/rsync
Events
Introduced
461c6de1a8f2d6eac44e607c6862f356915e579d
Fixed
471e17dc0d68233db84db11be82c9f62f4661214
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.3.3"
                },
                {
                    "fixed": "3.5.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "original_tag": "v3.5.0",
            "range": [
                {
                    "fixed": "471e17dc0d68233db84db11be82c9f62f4661214"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70460.json"