CVE-2024-12088
highA flaw was found in rsync.
Vendor / product: Samba — rsync
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2025-01-14 18:15
Modified: 2026-11-05 12:17
NVD status: Modified
Last synced 6 days ago
Verified against the source API 2026-11-05 12:46 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
samba / rsync ≤3.3.0
redhat / discovery 1.14
redhat / openshift_container_platform 4.0
redhat / enterprise_linux 6.0, 7.0, 8.0, 9.0, 10.0
redhat / enterprise_linux_eus 9.6
redhat / enterprise_linux_for_arm_64 8.0_aarch64, 9.0_aarch64
redhat / enterprise_linux_for_arm_64_eus 9.6_aarch64
redhat / enterprise_linux_for_ibm_z_systems 8.0_s390x, 9.0_s390x
redhat / enterprise_linux_for_ibm_z_systems_eus 9.6_s390x
redhat / enterprise_linux_for_power_little_endian 8.0_ppc64le, 9.0_ppc64le
redhat / enterprise_linux_for_power_little_endian_eus 9.6_ppc64le
redhat / enterprise_linux_server_aus 9.6
redhat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.6_ppc64le
redhat / enterprise_linux_update_services_for_sap_solutions 9.6
archlinux / arch_linux all versions
gentoo / linux all versions
nixos / nixos <24.11
novell / suse_linux all versions
tritondatacenter / smartos <20250123
almalinux / almalinux 8.0, 9.0, 10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://access.redhat.com/errata/RHBA-2025:6470 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:2600 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:7050 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2025:8385 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2024-12088 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2330676 secalert@redhat.com
- https://kb.cert.org/vuls/id/952657 secalert@redhat.com
- https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html af854a3a-2127-422b-91ae-364da2661108
- https://security.netapp.com/advisory/ntap-20250131-0002/ af854a3a-2127-422b-91ae-364da2661108
- https://www.kb.cert.org/vuls/id/952657 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-11-05 12:46 UTC · record ↗