Dashboard / CVE-2024-12088

CVE-2024-12088

HIGH
MEDIUM Priority: 0.35 BB Relevance: 76/100
Published: 2025-01-14 Modified: 2026-11-05 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: High
A: None

Description

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

Weakness Classification (1)

Affected Software (31)

VendorProductVersion
— — 0
— — 0
almalinux almalinux 8.0
almalinux almalinux 9.0
almalinux almalinux 10.0
archlinux arch_linux -
gentoo linux -
nixos nixos < 24.11
novell suse_linux -
redhat discovery 1.14
redhat enterprise_linux 6.0
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat enterprise_linux 10.0
redhat enterprise_linux_eus 9.6
redhat enterprise_linux_for_arm_64 8.0_aarch64
redhat enterprise_linux_for_arm_64 9.0_aarch64
redhat enterprise_linux_for_arm_64_eus 9.6_aarch64
redhat enterprise_linux_for_ibm_z_systems 8.0_s390x
redhat enterprise_linux_for_ibm_z_systems 9.0_s390x
redhat enterprise_linux_for_ibm_z_systems_eus 9.6_s390x
redhat enterprise_linux_for_power_little_endian 8.0_ppc64le
redhat enterprise_linux_for_power_little_endian 9.0_ppc64le
redhat enterprise_linux_for_power_little_endian_eus 9.6_ppc64le
redhat enterprise_linux_server_aus 9.6
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.6_ppc64le
redhat enterprise_linux_update_services_for_sap_solutions 9.6
redhat openshift_container_platform 4.0
samba rsync < 3.3.0
Showing 30 of 31 entries

References & Advisories (11)

https://access.redhat.com/errata/RHBA-2025:6470
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:2600
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7050
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:8385
vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2330676
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

76 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

4.65%
Raw Score 0.046460
Percentile 91.8%
Date 2026-11-08

EPSS Trend

2026-11-08
0.04646
2026-11-07
0.04646
2026-11-06
0.04646
2026-11-05
0.04646
2026-11-04
0.04646
2026-11-03
0.04646

Intelligence Sources

mitre ref →
nvd ref →

External Links