The vulnerability CVE-2024-12088 affects the rsync utility's handling of symbolic links when the --safe-links option is enabled. The client does not correctly verify if a symbolic link destination sent from the server contains another symbolic link, resulting in a path traversal vulnerability. This flaw can lead to arbitrary file writes outside the intended directory. The issue has been addressed in security updates released by Red Hat for their Enterprise Linux 8 and 10 distributions. The updates include fixes that properly validate symbolic link destinations to prevent bypassing the --safe-links protection.

Successful exploitation of this vulnerability allows an attacker to write files outside the target directory during rsync operations with the --safe-links option enabled. This can lead to unauthorized modification of files, potentially impacting system integrity. The vulnerability does not affect confidentiality or availability directly. No known active exploits have been reported.

Red Hat has released official security updates for Red Hat Enterprise Linux 8 and 10 that fix this vulnerability. Applying these updates will remediate the issue. Users should update their rsync packages to the fixed versions as detailed in the Red Hat advisories RHBA-2025:6470 and RHSA-2025:2600. Patch status is confirmed as official-fix by the vendor advisories. No additional mitigation steps are required beyond applying the vendor-provided updates.