RsyncProject rsync up to 3.4.2 toctou

Summaryinfo

A vulnerability described as problematic has been identified in RsyncProject rsync up to 3.4.2. The impacted element is an unknown function. The manipulation results in toctou. This vulnerability is identified as CVE-2026-29518. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in RsyncProject rsync up to 3.4.2. It has been classified as problematic. Affected is an unknown code block. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

The weakness was released by Nullx3D. The advisory is available at github.com. This vulnerability is traded as CVE-2026-29518 since 03/04/2026. The exploitability is told to be difficult. Local access is required to approach this attack. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 315780 (Debian dla-4591 : rsync - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.4.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (315780) and CERT Bund (WID-SEC-2026-1611). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Debian Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Open Source Rsync
• SUSE openSUSE

Productinfo

Type

• File Transfer Software

Vendor

• RsyncProject

Name

• rsync

Version

• 3.4.0
• 3.4.1
• 3.4.2

Website

• Product: https://github.com/RsyncProject/rsync/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion