News › security
By Zayden R., August 13, 2026
Rsync 3.5 is out with 33 security fixes following a thorough audit focused on path handling and daemon protocol. Engineers should update to address critical vulnerabilities like arbitrary file read and privilege escalation.
Rsync, the ubiquitous open-source tool for file synchronization across networks, has just received a critical update with its 3.5 release. This update is particularly significant as it addresses 33 security vulnerabilities identified during an intensive audit of its path handling and daemon protocol. For engineers and sysadmins relying on Rsync, this update isn't just recommended, it's essential.
The Rsync 3.5 release comes as a response to various security flaws, including serious vulnerabilities such as arbitrary file read and privilege escalation through symlinked paths. These issues have been recognized as high CVEs, underscoring the potential risk they posed to systems. The update is described as "extraordinary" in the Rsync NEWS announcement, reflecting the sheer volume and criticality of the fixes.
For those managing their own builds, the latest Rsync sources are available on Samba.org. Given the nature of the vulnerabilities addressed, it's advisable for users to prioritize this update to maintain the security integrity of their systems.
This release marks a significant step in ensuring the safety and reliability of Rsync, which remains a staple in file synchronization tasks across various platforms. By addressing these vulnerabilities, Rsync 3.5 reinforces the software's commitment to secure operations. Engineers should take immediate action to implement this update and safeguard their infrastructure.
The Linux Camp teaches these topics as hands-on labs on real virtual machines, verified as you type.