Rsync Daemon File Handling Vulnerability in Rsync by Rsync Project

CVE-2026-29518

What is CVE-2026-29518?

Rsync versions prior to 3.4.3 are susceptible to a time-of-check to time-of-use (TOCTOU) race condition in the handling of daemon file operations. This vulnerability allows an attacker, who has write permissions to a module path, to exploit the race condition to redirect file writes to unintended directories. By replacing components of the parent directory with symbolic links, the attacker can create or overwrite arbitrary files. Should the daemon operate with elevated privileges and the chroot setting be disabled, this manipulation can potentially modify sensitive system files and lead to privilege escalation.

References