---
id: CVE-2024-12088
title: A flaw was found in rsync
summary: >-
  A flaw was found in rsync. When using the `--safe-links` option, the rsync
  client fails to properly verify if a symbolic link destination sent from the
  server contains another symbolic link within it. This results in a path
  traversal vul…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
  - CWE-22
vendor: samba
product: rsync
affected:
  - rsync <= 3.3.0
  - discovery = 1.14
  - openshift_container_platform = 4.0
  - enterprise_linux = 6.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux = 10.0
  - enterprise_linux_eus = 9.6
  - enterprise_linux_for_arm_64 = 8.0_aarch64
  - enterprise_linux_for_arm_64 = 9.0_aarch64
  - enterprise_linux_for_arm_64_eus = 9.6_aarch64
  - enterprise_linux_for_ibm_z_systems = 8.0_s390x
  - enterprise_linux_for_ibm_z_systems = 9.0_s390x
  - enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x
  - enterprise_linux_for_power_little_endian = 8.0_ppc64le
  - enterprise_linux_for_power_little_endian = 9.0_ppc64le
  - enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le
  - enterprise_linux_server_aus = 9.6
  - >-
    enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
    = 9.6_ppc64le
  - enterprise_linux_update_services_for_sap_solutions = 9.6
  - arch_linux
  - linux
  - nixos < 24.11
  - suse_linux
  - smartos < 20250123
  - almalinux = 8.0
  - almalinux = 9.0
  - almalinux = 10.0
patched:
  - nixos 24.11
  - smartos 20250123
published: '2025-01-14'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-12088'
references:
  - url: 'https://access.redhat.com/errata/RHBA-2025:6470'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2600'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7050'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:8385'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-12088'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2330676'
    label: secalert@redhat.com
  - url: 'https://kb.cert.org/vuls/id/952657'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250131-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/952657'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.04745
epssPercentile: 0.91551
ingestedAt: '2026-06-29T13:24:34.148Z'
---

## Overview

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

## Affected

- `rsync <= 3.3.0`
- `discovery = 1.14`
- `openshift_container_platform = 4.0`
- `enterprise_linux = 6.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux = 10.0`
- `enterprise_linux_eus = 9.6`
- `enterprise_linux_for_arm_64 = 8.0_aarch64`
- `enterprise_linux_for_arm_64 = 9.0_aarch64`
- `enterprise_linux_for_arm_64_eus = 9.6_aarch64`
- `enterprise_linux_for_ibm_z_systems = 8.0_s390x`
- `enterprise_linux_for_ibm_z_systems = 9.0_s390x`
- `enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x`
- `enterprise_linux_for_power_little_endian = 8.0_ppc64le`
- `enterprise_linux_for_power_little_endian = 9.0_ppc64le`
- `enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le`
- `enterprise_linux_server_aus = 9.6`
- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64le`
- `enterprise_linux_update_services_for_sap_solutions = 9.6`
- `arch_linux`
- `linux`
- `nixos < 24.11`
- `suse_linux`
- `smartos < 20250123`
- `almalinux = 8.0`
- `almalinux = 9.0`
- `almalinux = 10.0`

## Remediation

Upgrade past the affected range:

- `nixos 24.11`
- `smartos 20250123`