What’s Vulnerable › Vulnerabilities

CVE-2024-12088: Rsync: --safe-links option bypass leads to path traversal

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-14 · updated 2026-10-21
• Weakness: CWE-22

Description

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Affected products

• Almalinux: 8.0, 9.0, 10.0
• Archlinux Arch Linux: all versions
• gentoo Linux: all versions
• Nixos: before 24.11 — fixed in 24.11
• Novell Suse Linux: all versions
• RedHat Discovery: 1.14
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
• RedHat Enterprise Linux Eus: 9.6
• RedHat Enterprise Linux For Arm 64: 8.0_aarch64, 9.0_aarch64
• RedHat Enterprise Linux For Arm 64 Eus: 9.6_aarch64
• RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x, 9.0_s390x
• RedHat Enterprise Linux For Ibm Z Systems Eus: 9.6_s390x
• RedHat Enterprise Linux For Power Little Endian: 8.0_ppc64le, 9.0_ppc64le
• RedHat Enterprise Linux For Power Little Endian Eus: 9.6_ppc64le
• RedHat Enterprise Linux Server Aus: 9.6
• RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 9.6_ppc64le
• RedHat Enterprise Linux Update Services For Sap Solutions: 9.6
• Red Hat OpenShift Container Platform 4.18: 4.0
• RsyncProject rsync: through 3.3.0
• Tritondatacenter Smartos: before 20250123 — fixed in 20250123

How to fix

Upgrade to a fixed version: Nixos 24.11; Tritondatacenter Smartos 20250123. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHBA-2025:6470
• https://access.redhat.com/errata/RHSA-2025:2600
• https://access.redhat.com/errata/RHSA-2025:7050
• https://access.redhat.com/errata/RHSA-2025:8385
• https://access.redhat.com/security/cve/CVE-2024-12088
• https://bugzilla.redhat.com/show_bug.cgi?id=2330676
• https://kb.cert.org/vuls/id/952657
• https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
• https://security.netapp.com/advisory/ntap-20250131-0002/
• https://www.kb.cert.org/vuls/id/952657
• https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj

Get alerted when CVE-2024-12088 or the next vulnerability affects your stack