Symlink Race Condition Vulnerability in Rsync by Rsync Project

CVE-2026-43619

What is CVE-2026-43619?

Rsync versions 3.4.2 and earlier are susceptible to symlink race condition vulnerabilities due to insecure handling of path-based system calls, including chmod, lchown, and rename. This flaw allows local attackers, with access to the filesystem, to exploit a timing window between path resolution and syscall execution. By swapping symlinks, attackers can apply arbitrary permissions, ownership, timestamps, or filenames to files outside the designated rsync module, particularly in environments where the 'use chroot = no' setting is configured on rsync daemons.

References