Local File Permission Vulnerability in Rsync by RsyncProject
CVE-2026-44509

6.3MEDIUM

Key Information:

Vendor

Rsyncproject

Status
Rsync
Vendor
CVE Published:
20 July 2026

What is CVE-2026-44509?

Rsync, a widely used file-copying tool, has a local file permission vulnerability that allows attackers with local filesystem access to manipulate file permissions, ownership, or timestamps. This issue arises in versions prior to 3.4.3 due to overlooked races in path-based system calls like chmod() and chown() when 'use chroot = no' is configured. The flaw potentially enables unauthorized access to files outside the defined module, creating security risks. The vulnerability has been addressed in the latest version, ensuring better protection for users.

Affected Version(s)

rsync < 3.4.3

References

https://github.com/RsyncProject/rsync/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.