Skip to main content

Rsync EUVDEUVD-2026-31100

| CVE-2026-29518 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-05-20 VulnCheck GHSA-pfv9-gp3h-73xv
Privilege Escalation Rsync Rsyncproject
High
Disputed · 7.3 Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-priv write access to non-chroot module
  2. Delivery
    Initiate rsync write to target path
  3. Exploit
    Race-swap parent directory for symlink
  4. Execution
    Daemon open() follows symlink outside module
  5. Persist
    Overwrite privileged file (e.g. authorized_keys, sudoers.d)
  6. Impact
    Escalate to root

Vulnerability Assessment

Weakness
CWE
CWE-367
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions

The rsync daemon must be running with at least one module configured 'use chroot = no' in rsyncd.conf - this is non-default; the upstream default 'use chroot = yes' is not exposed. The attacker must have authenticated write access to that module (CVSS PR:L) and local presence sufficient to stage rapid symlink replacement on a parent directory component (CVSS AV:L, AC:H reflects the race window). Privilege escalation impact materializes only when the daemon runs with elevated privileges (typically root), which is the common deployment. Default-configured rsyncd installations, read-only modules, and modules where the attacker lacks write permission are not exploitable.
Impact

CVSS v4.0 7.3 with vector AV:L/AC:H/PR:L/UI:N indicates a local, high-complexity attack requiring at least low-privileged module write access - not a remote unauthenticated bug, despite high VC/VI/VA. The race window is narrow, raising AC:H, and exploitation is gated by the non-default 'use chroot = no' module setting, which materially limits exposed populations to administrators who explicitly disabled chroot (common in containerized backup hosts and read-only mirroring setups). No EPSS score, no KEV listing, and no POC referenced in the provided data, so this is best treated as a credible privilege-escalation primitive on specific deployments rather than a mass-exploitation candidate. The vendor confirmed the bug class is broader than this single CVE (see follow-on CVE-2026-43619 covering chmod/lchown/utimes/rename/etc.), suggesting defenders should patch holistically rather than treat 29518 in isolation.
Exploit ScenarioDerived

On a backup server running rsyncd with a module configured 'use chroot = no' and writable by a low-privileged account, the attacker initiates an rsync push to that module while a concurrent process repeatedly replaces a parent directory component of the target path with a symlink to /etc or another sensitive directory. Winning the race between the daemon's path check and open() causes rsync - typically running as root for system backups - to write attacker-controlled content into /etc/sudoers.d/, /root/.ssh/authorized_keys, or a similar file, yielding root. No public PoC is referenced, though the upstream regression tests (bare-do-open-symlink-race, chdir-symlink-race, chmod-symlink-race) added in the fix commit demonstrate the race is reproducible.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 20, 2026

Local privilege escalation in Rsync daemon (versions ≤ 3.4.2) is possible via a TOCTOU symlink race when the daemon is configured with 'use chroot = no'. An authenticated local attacker with write access to a module can swap a parent directory component for a symlink between the receiver's path check and its open() call, redirecting writes outside the module and overwriting sensitive files. No public exploit identified at time of analysis, but the upstream patch in release 3.4.3 and a detailed VulnCheck advisory disclose the precise race window.

RemediationAI

Vendor-released patch: rsync 3.4.3 - upgrade all daemon hosts to this version (https://github.com/RsyncProject/rsync/releases/tag/v3.4.3), which routes daemon-no-chroot path opens through the existing secure_relative_open() helper. If immediate upgrade is not possible, the most effective workaround is to set 'use chroot = yes' for every module in rsyncd.conf, which fully avoids the vulnerable code path; the trade-off is that chroot requires the daemon to run as root to chroot() and constrains module path semantics (no following symlinks out of the module root, restricted UID/GID lookups). As a secondary mitigation, restrict module write access - including 'auth users' lists and 'hosts allow' rules - so untrusted local or network principals cannot stage the racing symlink. Also pull in the same 3.4.3 release to get sibling fixes (CVE-2026-43617 through CVE-2026-45232), since the upstream advisory notes related issues that landed together.

Affected VersionsENISA

rsync 0 <3.4.3

Affected Packages

euvd rsync fix: 3.4.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Rsync is a widely deployed file-synchronization daemon written in C. The flaw is a classic CWE-367 time-of-check to time-of-use race on parent path components handled by the daemon's receiver process. Per the upstream NEWS entry, the helper secure_relative_open() - originally introduced in 3.4.0 to address CVE-2024-12086 - was not invoked on the daemon-no-chroot code path, leaving path resolution susceptible to interleaved symlink replacement. CPE cpe:2.3:a:rsyncproject:rsync:*:*:*:*:*:*:*:* covers all rsync builds from the upstream RsyncProject prior to 3.4.3, including embedded uses in Linux distributions and storage appliances.

Know when Rsync gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (VulnCheck) PRIMARY 7.3 HIGH
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 3.1 LOW
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
High
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
CVSS changed
May 20, 2026 - 13:22 NVD
7.0 (HIGH) 7.3 (HIGH)

DescriptionCVE.org

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Executive ViewAI

Why It Matters

Rsync daemon versions 3.4.2 and earlier enable local privilege escalation when configured with 'use chroot = no', permitting authenticated users to overwrite files outside their authorized scope and gain elevated privileges. Organizations running Rsync in this configuration face direct risk of system compromise and unauthorized data modification. Urgent remediation is required.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations: (1) Configure 'use chroot = yes' in Rsync daemon settings to isolate filesystem access; (2) Restrict write permissions on modules via filesystem permissions; (3) Limit local user accounts with module write access; (4) Enable and audit Rsync daemon logs for suspicious path operations; (5) Periodically review module configuration and access control policy. Exploitation requires local authentication and write access to a module-assess organizational exposure based on local user population.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Social Media
3
Sightings
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Rsync

View all
CVE-2024-12085 HIGH POC
7.5 Jan 14

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
CVE-2024-12084 CRITICAL POC
9.8 Jan 15

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2014-9512 MEDIUM POC
6.4 Feb 12

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization pa
CVE-2024-12087 HIGH POC
7.5 Jan 14

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
CVE-2022-29154 HIGH POC
7.4 Aug 02

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d
CVE-2014-2855 HIGH
7.8 Apr 23

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of serv
CVE-2024-12086 MEDIUM POC
6.8 Jan 14

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati
CVE-2017-16548 CRITICAL
9.8 Nov 06

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character
CVE-2017-17434 CRITICAL
9.8 Dec 06

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_
CVE-2017-15994 CRITICAL
9.8 Oct 29

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to by
CVE-2026-53790 CRITICAL
9.2 Aug 13

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG e
CVE-2026-70460 CRITICAL
9.2 Aug 13

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symli

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-Azure Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-29518 ADVISORY https://ubuntu.com/security/notices/USN-8283-1 ADVISORY https://vuldb.com/vuln/364866 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2038/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21726/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21739/ REF https://access.redhat.com/errata/RHSA-2026:26332 REF https://access.redhat.com/errata/RHSA-2026:26408 REF https://access.redhat.com/errata/RHSA-2026:26410 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:54769 REF https://access.redhat.com/security/cve/CVE-2026-29518 REF https://bugzilla.redhat.com/show_bug.cgi?id=2469055 REF https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d REF https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 REF https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/ REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json REF https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy