Search: CVE-2026-70460

A path traversal vulnerability exists in rsync versions 2.3.3 through 3.4.4. This flaw allows a malicious sender to escape the intended module root directory by exploiting symbolic links when using the --partial-dir or --backup-dir options. An attacker with write access to place or leverage symlinks can cause arbitrary file writes outside the module root.