Medium 6.5Published Jan 14, 2025

CVE-2024-12088Rsync: --safe-links option bypass leads to path traversal

Updated under an hour ago (Oct 27, 2026, 6:10 PM ET)

Does this affect you?

It affects Red Hat Enterprise Linux 10 and 20 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Red Hat Enterprise Linux 10

Exploited in the last 30 days

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: redhat
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 21, 2026

Affected products

Affected products

Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	from 0:3.4.1-2.el10 not affected	CNA record
Red Hat Red Hat Discovery 1.14 redhat:discovery	from 1.14.2-1748467619 not affected	CNA record
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift	4	CNA record
samba rsync samba:rsync	through 3.3.0	NVD
redhat discovery redhat:discovery	1.14	NVD
redhat openshift_container_platform redhat:openshift_container_platform	4.0	NVD
redhat enterprise_linux redhat:enterprise_linux	6.0; 7.0; 8.0; 9.0; 10.0	NVD
redhat enterprise_linux_eus redhat:enterprise_linux_eus	9.6	NVD
redhat enterprise_linux_for_arm_64 redhat:enterprise_linux_for_arm_64	8.0_aarch64; 9.0_aarch64	NVD
redhat enterprise_linux_for_arm_64_eus redhat:enterprise_linux_for_arm_64_eus	9.6_aarch64	NVD
1–10 of 23

References

References

https://access.redhat.com/errata/RHBA-2025:6470	vendor-advisory, x-refsource-redhat
https://access.redhat.com/errata/RHSA-2025:2600	vendor-advisory, x-refsource-redhat, third-party-advisory
https://access.redhat.com/errata/RHSA-2025:7050	vendor-advisory, x-refsource-redhat, third-party-advisory
https://access.redhat.com/errata/RHSA-2025:8385	vendor-advisory, x-refsource-redhat, third-party-advisory
https://access.redhat.com/security/cve/CVE-2024-12088	vdb-entry, x-refsource-redhat, third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2330676	issue-tracking, x-refsource-redhat, third-party-advisory
https://kb.cert.org/vuls/id/952657	third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
https://security.netapp.com/advisory/ntap-20250131-0002/
https://www.kb.cert.org/vuls/id/952657
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.