CVE-2026-29518

Published: Mag 20, 2026 Last Modified: Mag 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,3
Attack Vector: local
Attack Complexity: high
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,0
Attack Vector: local
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

367

Time-of-check Time-of-use (TOCTOU) Race Condition

Incomplete
Common Consequences
Security Scopes Affected:
Integrity Other Non-Repudiation
Potential Impacts:
Alter Execution Logic Unexpected State Modify Application Data Modify Files Or Directories Modify Memory Other Hide Activities
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44…
https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink…