---
id: CVE-2024-12087
title: A path traversal vulnerability exists in rsync
summary: >-
  A path traversal vulnerability exists in rsync. It stems from behavior enabled
  by the `--inc-recursive` option, a default-enabled option for many client
  options and can be enabled by the server even if not explicitly enabled by the
  clien…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
  - CWE-22
vendor: samba
product: rsync
affected:
  - rsync <= 3.3.0
  - almalinux = 8.0
  - almalinux = 9.0
  - almalinux = 10.0
  - arch_linux
  - linux
  - nixos < 24.11
  - suse_linux
  - smartos < 20250123
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux_eus = 9.6
  - enterprise_linux_for_arm_64 = 8.0_aarch64
  - enterprise_linux_for_arm_64 = 9.0_aarch64
  - enterprise_linux_for_arm_64_eus = 9.6_aarch64
  - enterprise_linux_for_ibm_z_systems = 8.0_s390x
  - enterprise_linux_for_ibm_z_systems = 9.0_s390x
  - enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x
  - enterprise_linux_for_power_little_endian = 8.0_ppc64le
  - enterprise_linux_for_power_little_endian = 9.0_ppc64le
  - enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le
  - enterprise_linux_server_aus = 9.6
  - >-
    enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
    = 9.6_ppc64le
  - enterprise_linux_update_services_for_sap_solutions = 9.6
patched:
  - nixos 24.11
  - smartos 20250123
published: '2025-01-14'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-12087'
references:
  - url: 'https://access.redhat.com/errata/RHBA-2025:6470'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23154'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23235'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23407'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23415'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23416'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23842'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23853'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23854'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:23858'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2600'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7050'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:8385'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-12087'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2330672'
    label: secalert@redhat.com
  - url: 'https://kb.cert.org/vuls/id/952657'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250131-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/952657'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.02307
epssPercentile: 0.82646
ingestedAt: '2026-06-29T13:24:34.147Z'
---

## Overview

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

## Affected

- `rsync <= 3.3.0`
- `almalinux = 8.0`
- `almalinux = 9.0`
- `almalinux = 10.0`
- `arch_linux`
- `linux`
- `nixos < 24.11`
- `suse_linux`
- `smartos < 20250123`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux_eus = 9.6`
- `enterprise_linux_for_arm_64 = 8.0_aarch64`
- `enterprise_linux_for_arm_64 = 9.0_aarch64`
- `enterprise_linux_for_arm_64_eus = 9.6_aarch64`
- `enterprise_linux_for_ibm_z_systems = 8.0_s390x`
- `enterprise_linux_for_ibm_z_systems = 9.0_s390x`
- `enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x`
- `enterprise_linux_for_power_little_endian = 8.0_ppc64le`
- `enterprise_linux_for_power_little_endian = 9.0_ppc64le`
- `enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le`
- `enterprise_linux_server_aus = 9.6`
- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64le`
- `enterprise_linux_update_services_for_sap_solutions = 9.6`

## Remediation

Upgrade past the affected range:

- `nixos 24.11`
- `smartos 20250123`