CVE-2004-0426: Andrew Tridgell Rsync

Medium severity, CVSS 5.0. EPSS: 3.4% chance of exploitation in the next 30 days.

rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.

Affected products

• Andrew Tridgell Rsync: up to and including 2.6

Published 2004-07-07. Last modified 2026-06-16.