Is CVE-2026-44509 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44509 being exploited in the wild.

How severe is CVE-2026-44509?

Medium severity, with a CVSS score of 6.3, published 20 July 2026.

Is there a fix for CVE-2026-44509?

A patch was published on 2026-07-20: Fix released in version 3.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44509 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-44509?

Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44509: RsyncProject rsync symlink race in path-based syscalls

CVE-2026-44509 · Severity: medium · CVSS 6.3 · Published 2026-07-20

Rsync, a widely used tool for synchronizing files between computers, contains a security flaw that could allow an attacker to modify files they shouldn't have access to. If the software is configured without certain security restrictions (specifically when 'chroot' is disabled), a local user can trick the system into changing the ownership, permissions, or timestamps of sensitive files outside of the intended sync folder. This could lead to unauthorized data access or system instability by tampering with critical files.

Technologies: RsyncProject Rsync. Vendors: RsyncProject.

Quick answers

Is CVE-2026-44509 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44509 being exploited in the wild.
How severe is CVE-2026-44509?: Medium severity, with a CVSS score of 6.3, published 20 July 2026.
Which products and versions are affected?: RsyncProject Rsync < 3.4.3.
Is there a fix for CVE-2026-44509?: A patch was published on 2026-07-20: Fix released in version 3.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44509 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-44509?: Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Rsync versions prior to 3.4.3 are vulnerable to Time-of-Check Time-of-Use (TOCTOU) race conditions (CWE-367) and improper link resolution (CWE-59). While previous fixes addressed symlink races in open() calls, other path-based system calls such as chmod(), chown(), utimes(), rename(), and unlink() remained vulnerable. When the rsync daemon is configured with 'use chroot = no', a local attacker can exploit these races to manipulate files, directories, or device nodes outside of the designated module path. This allows for unauthorized modification of file permissions, ownership, and timestamps. The issue is resolved in version 3.4.3; a recommended workaround is to ensure 'use chroot = yes' is enabled.

Affected products

RsyncProject rsync < 3.4.3

Timeline

2026-05-20: advisory: GitHub advisory published by maintainers
2026-07-20: disclosed: CVE published to NVD
2026-07-20: patched: Fix released in version 3.4.3

References

https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.