Executive brief
Rsync, a widely used tool for synchronizing files between computers, contains a security flaw that could allow an attacker to modify files they shouldn't have access to. If the software is configured without certain security restrictions (specifically when 'chroot' is disabled), a local user can trick the system into changing the ownership, permissions, or timestamps of sensitive files outside of the intended sync folder. This could lead to unauthorized data access or system instability by tampering with critical files.
Technical details
Rsync versions prior to 3.4.3 are vulnerable to Time-of-Check Time-of-Use (TOCTOU) race conditions (CWE-367) and improper link resolution (CWE-59). While previous fixes addressed symlink races in open() calls, other path-based system calls such as chmod(), chown(), utimes(), rename(), and unlink() remained vulnerable. When the rsync daemon is configured with 'use chroot = no', a local attacker can exploit these races to manipulate files, directories, or device nodes outside of the designated module path. This allows for unauthorized modification of file permissions, ownership, and timestamps. The issue is resolved in version 3.4.3; a recommended workaround is to ensure 'use chroot = yes' is enabled.
Affected products
- RsyncProject rsync < 3.4.3
Timeline
- 2026-05-20: advisory: GitHub advisory published by maintainers
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Fix released in version 3.4.3