CVE-2007-6199
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows...
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
Exploit likelihood
What each source reports
NVD Score used
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
- Record
CVE-2007-6199- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE ListNo score
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
- Record
CVE-2007-6199- Updated
- 2026-11-02
EUVDEUVD-2007-6167No score
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
- Record
EUVD-2007-6167- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r5c5-5849-8rr9No score
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows...
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
- Record
GHSA-r5c5-5849-8rr9- Updated
- 2026-11-02
OSVNo score
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
- Record
CVE-2007-6199- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6199No score
rsync before 3.0.0pre6, when running a writable rsync daemon that is not using chroot, allows remote attackers to access restricted files via unknown vectors that cause rsync to create a symlink that points outside of the module's hierarchy.
- Record
DEBIAN-CVE-2007-6199- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11308-1No score
rsync-3.2.3-2.6 on GA media
These are all security issues fixed in the rsync-3.2.3-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11308-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6199 is a high vulnerability (CVSS 9.3) in Rsync, published December 1, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.14%, the 90th percentile. Fixed in rsync 2.6.9-6.
References
secunia.com/advisories/28412
support.f5.com/kb/en-us/solutions/public/15000/500/sol15549.html
vupen.com/english/advisories/2007/4057
lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
Show 19 moreShow less
securityfocus.com/archive/1/487991/100/0/threaded
wiki.rpath.com/wiki/Advisories:rPSA-2007-0257
rsync.samba.org/security.html
mandriva.com/en/security/advisories?name=MDVSA-2008:011
securitytracker.com/id?1019012
lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
nvd.nist.gov/vuln/detail/CVE-2007-6199
github.com/advisories/GHSA-r5c5-5849-8rr9
security-tracker.debian.org/tracker/CVE-2007-6199
suse.com/security/cve/CVE-2007-4091