---
id: CVE-2024-12747
title: A flaw was found in rsync
summary: >-
  A flaw was found in rsync. This vulnerability arises from a race condition
  during rsync's handling of symbolic links. Rsync's default behavior when
  encountering symbolic links is to skip them. If an attacker replaced a regular
  file with …
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-362
published: '2025-01-14'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-12747'
references:
  - url: 'https://access.redhat.com/errata/RHBA-2025:6470'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:2600'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:7050'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:8385'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-12747'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2332968'
    label: secalert@redhat.com
  - url: 'https://kb.cert.org/vuls/id/952657'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250131-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/952657'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00384
epssPercentile: 0.2965
ingestedAt: '2026-06-29T13:24:34.149Z'
---

## Overview

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.