CVE-2026-29518
published 2026-05-20CVE-2026-29518: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file…
PriorityP337high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.15%
4.8th percentile
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rsyncproject | rsync | < 3.4.3 | 3.4.3 |
| samba | rsync | < 3.4.3 | 3.4.3 |
| samba | rsync | — | — |
| ubuntu | rsync | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.3HIGHCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.3HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
rsync regression
vendor_ubuntu·2026-06-16·CVSS 4.3
CVE-2025-10158 [MEDIUM] rsync regression
Title: rsync regression
Summary: USN-8349-1 introduced regressions in rsync.
USN-8349-1 fixed vulnerabilities in rsync. Unfortunately that update introduced multiple
regressions in rsync functionality. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Calum Hutton discovered that rsync contained a heap-based out-of-bounds
read when handling file transfers. A remote attacker with read access
to an rsync server could possibly use this issue to cause a denial of
service. (CVE-2025-10158)
Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that
rsync daemons configured without chroot protection were exposed to a
race condition on parent path components. A local attacker with write
access to a module could possibly use this issue to o
Ubuntu
rsync regression
vendor_ubuntu·2026-06-08·CVSS 4.3
CVE-2025-10158 [MEDIUM] rsync regression
Title: rsync regression
Summary: USN-8349-1 introduced regressions in rsync.
USN-8349-1 fixed vulnerabilities in rsync. The update introduced multiple
regressions in rsync functionality. This update fixes the problem.
Original advisory details:
Calum Hutton discovered that rsync contained a heap-based out-of-bounds
read when handling file transfers. A remote attacker with read access
to an rsync server could possibly use this issue to cause a denial of
service. (CVE-2025-10158)
Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that
rsync daemons configured without chroot protection were exposed to a
race condition on parent path components. A local attacker with write
access to a module could possibly use this issue to overwrite files,
obtain sensitive information, or esc
Ubuntu
rsync vulnerabilities
vendor_ubuntu·2026-06-01·CVSS 4.3
CVE-2026-43618 [MEDIUM] rsync vulnerabilities
Title: rsync vulnerabilities
Summary: Several security issues were fixed in rsync.
Calum Hutton discovered that rsync contained a heap-based out-of-bounds
read when handling file transfers. A remote attacker with read access
to an rsync server could possibly use this issue to cause a denial of
service. (CVE-2025-10158)
Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that
rsync daemons configured without chroot protection were exposed to a
race condition on parent path components. A local attacker with write
access to a module could possibly use this issue to overwrite files,
obtain sensitive information, or escalate privileges.
(CVE-2026-29518)
It was discovered that rsync did not properly validate a length value
while sorting extended attributes. An attacker could possi
Red Hat
rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.
vendor_redhat·2026-05-20·CVSS 7.3
CVE-2026-29518 [HIGH] CWE-367 rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.
rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.
A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed
to a time-of-check / time-of-use race on parent path components. A local
attacker with write access to a module can replace a parent directory
component with a symlink between the receiver's check and its open(),
redirecting reads (basis-file disclosure) and writes (file overwrite)
outside the module. Under elevated daemon privilege this allows privilege
escalation. Default "use chroot = yes" is not exposed.
Reach: local attacker on the daemon host, write access to a module path,
daemon configured with use chroot = no.
Statement: This flaw, a Time-of-Check Time-of-Use (TOCTOU) race condition, allows
Ubuntu
rsync vulnerabilities
vendor_ubuntu·2026-05-20·CVSS 4.3
CVE-2026-43620 [MEDIUM] rsync vulnerabilities
Title: rsync vulnerabilities
Summary: Several security issues were fixed in rsync.
Calum Hutton discovered that rsync contained a heap-based out-of-bounds
read when handling file transfers. A remote attacker with read access
to an rsync server could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 25.10. (CVE-2025-10158)
Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that
rsync daemons configured without chroot protection were exposed to a
race condition on parent path components. A local attacker with write
access to a module could possibly use this issue to overwrite files,
obtain sensitive information, or escalate privileges.
(CVE-2026-29518)
It was discovered that rsync did not properly val
VulDB
RsyncProject rsync up to 3.4.2 toctou (Nessus ID 315780 / WID-SEC-2026-1611)
vuldb·2026-06-02·CVSS 7.3
CVE-2026-29518 [HIGH] RsyncProject rsync up to 3.4.2 toctou (Nessus ID 315780 / WID-SEC-2026-1611)
A vulnerability marked as problematic has been reported in RsyncProject rsync up to 3.4.2. The affected element is an unknown function. The manipulation leads to time-of-check time-of-use.
This vulnerability is referenced as CVE-2026-29518. The attack can only be performed from a local environment. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
GHSA-pfv9-gp3h-73xv: Rsync versions before 3
ghsa_unreviewed·2026-05-20
CVE-2026-29518 [HIGH] CWE-367 GHSA-pfv9-gp3h-73xv: Rsync versions before 3
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
No detection rules found.
No public exploits indexed.
https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531dhttps://github.com/RsyncProject/rsync/releases/tag/v3.4.3https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-writehttps://access.redhat.com/errata/RHSA-2026:26332https://access.redhat.com/errata/RHSA-2026:26408https://access.redhat.com/errata/RHSA-2026:26410https://access.redhat.com/errata/RHSA-2026:29197https://access.redhat.com/security/cve/CVE-2026-29518https://bugzilla.redhat.com/show_bug.cgi?id=2469055https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json
2026-05-20
Published