CVE-2024-12087: 
rsync vulnerability analysis and mitigation

A path traversal vulnerability (CVE-2024-12087) was discovered in rsync affecting versions prior to 3.4.0. The vulnerability stems from behavior enabled by the --inc-recursive option, which is default-enabled for many client options and can be enabled by the server even if not explicitly enabled by the client (CERT VU, NVD). The vulnerability was disclosed on January 14, 2025.

The vulnerability occurs when using the --inc-recursive option, where a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis creates a security weakness. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) (NVD, Fortra).

When exploited, this vulnerability could allow a malicious server to write files outside of the client's intended destination directory. The server could write malicious files to arbitrary locations named after valid directories/paths on the client system (NVD, CERT VU).

Users are advised to upgrade to rsync version 3.4.0 or later, as this version addresses the vulnerability. Organizations should prioritize updating all instances of rsync in their environment to the patched version (Fortra).