---
title: "CVE-2024-12087: Rsync: path traversal vulnerability in rsync"
url: https://erroneo.us/security/cve/CVE-2024-12087/
description: "CVE-2024-12087 (rsync): A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-01-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-12087"
kev: false
cvss: 6.5
epss: 0.02259
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-12087: Rsync: path traversal vulnerability in rsync

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 2.3% , percentile 83: FIRST’s model estimates a 2.3% chance of exploitation activity in the next 30 days, higher than 83% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Editorial verdict: Check exposure. rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084) — Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0.

## What it is

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

## Affected products (CVE record)

-  rsync: <= 3.3.0
- Red Hat Red Hat Enterprise Linux 10: see advisory
- Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION: see advisory
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: see advisory
- Red Hat Red Hat Enterprise Linux 8: see advisory
- Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support: see advisory
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: see advisory
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: see advisory
- Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: see advisory
- Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service: see advisory

## Severity

- redhat CVSS 3.1: 6.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 2.26% probability of exploitation activity in the next 30 days; percentile 83.

## Sources

- [RHBA-2025:6470](https://access.redhat.com/errata/RHBA-2025:6470)
- [RHSA-2025:23154](https://access.redhat.com/errata/RHSA-2025:23154)
- [RHSA-2025:23235](https://access.redhat.com/errata/RHSA-2025:23235)
- [RHSA-2025:23407](https://access.redhat.com/errata/RHSA-2025:23407)
- [RHSA-2025:23415](https://access.redhat.com/errata/RHSA-2025:23415)
- [RHSA-2025:23416](https://access.redhat.com/errata/RHSA-2025:23416)
- [RHSA-2025:23842](https://access.redhat.com/errata/RHSA-2025:23842)
- [RHSA-2025:23853](https://access.redhat.com/errata/RHSA-2025:23853)
- [RHSA-2025:23854](https://access.redhat.com/errata/RHSA-2025:23854)
- [RHSA-2025:23858](https://access.redhat.com/errata/RHSA-2025:23858)
- [RHSA-2025:2600](https://access.redhat.com/errata/RHSA-2025:2600)
- [RHSA-2025:7050](https://access.redhat.com/errata/RHSA-2025:7050)
- [RHSA-2025:8385](https://access.redhat.com/errata/RHSA-2025:8385)
- [CVE.org record CVE-2024-12087](https://www.cve.org/CVERecord?id=CVE-2024-12087)
- [NVD entry CVE-2024-12087](https://nvd.nist.gov/vuln/detail/CVE-2024-12087)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2024-12087)
- [RHBZ#2330672](https://bugzilla.redhat.com/show_bug.cgi?id=2330672)
- [kb.cert.org](https://kb.cert.org/vuls/id/952657)
- [github.com](https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj)
- [security.netapp.com](https://security.netapp.com/advisory/ntap-20250131-0002/)
- [lists.debian.org](https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html)
- [kb.cert.org](https://www.kb.cert.org/vuls/id/952657)

---
Source page: https://erroneo.us/security/cve/CVE-2024-12087/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt