CVE-2026-29518: Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write
A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed.
Other sources
Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write
— Microsoft
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u4Fixed in 3.2.7-1+deb12u5Fixed in 3.4.1+ds1-5+deb13u3Fixed in 3.4.3+ds1-2 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.4.3 - Configuration
Set the rsync daemon configuration option "use chroot" to true (yes). The described TOCTOU symlink-based arbitrary file write is only triggerable when "use chroot" is false.
rsync daemon use chroot = yes - Compensating control
Ensure rsync daemon module paths are not writable by untrusted users; otherwise an attacker with write access to a module path can exploit the race condition to create/overwrite arbitrary files.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29518?
The severity of CVE-2026-29518 is high with a score of 7.3.
How do I fix CVE-2026-29518?
To fix CVE-2026-29518, upgrade Rsync to version 3.4.3 or later.
What type of vulnerability is CVE-2026-29518?
CVE-2026-29518 is a race condition vulnerability that occurs due to a TOCTOU issue.
What software is affected by CVE-2026-29518?
Rsync versions before 3.4.3, including Debian/Rsync and Samba rsync, are affected by CVE-2026-29518.
What kind of attack can CVE-2026-29518 enable?
CVE-2026-29518 allows attackers to perform symlink-based arbitrary file writes to unintended directories.