What’s Vulnerable › Vulnerabilities

CVE-2026-29518: Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-20 · updated 2026-08-19
• Weakness: CWE-367

Description

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Affected products

• RsyncProject rsync: before 3.4.3 — fixed in 3.4.3

How to fix

Upgrade to a fixed version: RsyncProject rsync 3.4.3. Check the vendor advisory for mitigations.

References

• https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d
• https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
• https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/
• https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write
• https://access.redhat.com/errata/RHSA-2026:26332
• https://access.redhat.com/errata/RHSA-2026:26408
• https://access.redhat.com/errata/RHSA-2026:26410
• https://access.redhat.com/errata/RHSA-2026:29197
• https://access.redhat.com/errata/RHSA-2026:54769
• https://access.redhat.com/security/cve/CVE-2026-29518
• https://bugzilla.redhat.com/show_bug.cgi?id=2469055
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json

Get alerted when CVE-2026-29518 or the next vulnerability affects your stack