csync2 CVE-2026-41051

csync2 is a file synchronization tool that relies on temporary directory creation during operation. When compiled with C99 or later C standards, the temporary directory handling mechanism fails to implement secure, race-condition-resistant creation patterns. The TOCTOU vulnerability class occurs when the code checks for directory existence and then creates it in separate operations, allowing an attacker to inject a symlink or create the directory between the check and the creation, leading to potential denial of service or file manipulation. The vulnerability is specific to compilation with modern C standards, suggesting the code may use standard library functions that changed behavior or the compiler optimization levels that expose timing windows in the temporary file creation sequence.