CVE-2026-70460 is a path-escape vulnerability in rsync's daemon mode that allows partial-dir or backup-dir writes to traverse symlinks and land outside the intended module root. The attack works because rsync's module system provides chroot-like isolation, but symlinks within module trees are permitted as a feature — and the partial-dir/backup-dir options explicitly redirect write paths. When a symlink points outside the module root (whether attacker-controlled or administrator-intended), these options will follow it, bypassing the module isolation boundary.
Check your rsync configurations immediately: any rsyncd.conf with modules that contain symlinks, where rsync is invoked with --partial-dir or --backup-dir, is vulnerable. The critical factor is privilege context. In container image builds, CI/CD pipelines, and content delivery systems, rsync typically runs as root — which means this isn't a file-scratching issue but a privilege escalation path to /etc, /var, or wherever the symlink leads.
The low EPSS score despite high CVSS is a detection failure, not evidence of difficulty. The code path — module root plus symlink plus alternate write directory — is obscure enough that standard vuln scanners don't model it. More concerning: the exploit leaves almost no forensic trace in standard logs. You cannot easily determine from audit logs whether a partial file landed inside or outside the module root unless you're explicitly monitoring for it.
Immediate actions: audit all rsyncd modules for internal symlinks and eliminate symlinks that point outside the module tree. If partial-dir or backup-dir are necessary, ensure they resolve to paths within the module root and that no symlinks in the module tree can escape it. Consider running rsyncd in a dedicated low-privilege user namespace rather than root, particularly in build environments. The remediation timeline will be extended — rsync in daemon mode is typically frozen in CI/CD pipelines and container images, and updating it requires validating entire deployment pipelines. Treat this as a systemic exposure, not an isolated CVE: the combination of frozen configurations, root privilege, and invisible exploitability means the actual attack surface may be far larger than current detection suggests.