Description

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T15:19:41.913Z",
  "pubdate": "2026-08-13T15:19:41.913Z",
  "executiveSummary": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in rsync before version 3.5.0, specifically within the rrsync restricted shell wrapper. This flaw allows authenticated clients to bypass enforced directory restrictions by manipulating path components during transfer processing. By substituting a symbolic link for a path component after validation but prior to file transfer, malicious actors can escape the intended directory subtree.\nAdditionally, attackers can leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file via rrsync to read or write arbitrary files outside the permitted boundaries. The risk implications include unauthorized data access, information disclosure, and potential file modification on the host system. Exploitation requires authentication and the ability to interact with the rrsync restricted shell, along with precise timing capabilities to win the TOCTOU race condition.",
  "technicalDetails": "The vulnerability resides in the rrsync restricted shell wrapper used in rsync versions prior to 3.5.0. The root cause is a classic time-of-check to time-of-use (TOCTOU) race condition combined with improper validation of command-line flags and symbolic link resolution during path handling. The vulnerable component is the path validation and transfer processing logic within rrsync.\nExploitation requires the attacker to be an authenticated client with access to the rrsync restricted shell. The attack flow proceeds in several steps: First, the client initiates a file transfer request specifying a target path. During the check phase, rrsync validates the requested path against the enforced directory restrictions. Between this validation check and the subsequent file transfer processing phase, the attacker rapidly substitutes a path component with a specially crafted symbolic link. Because rrsync evaluates the path at the validation stage but processes the transfer subsequently, the operation follows the newly introduced symlink.\nFurthermore, attackers can exploit unrestricted flags such as --copy-unsafe-links, -D, and --log-file that are incorrectly permitted or insufficiently sanitized by rrsync. These flags enable the manipulation and traversal of filesystem objects outside the permitted directory subtree, allowing for unauthorized reading or writing of files. Post-exploitation impact includes severe sandbox escape, unauthorized file disclosure, and arbitrary file write capabilities across the host system depending on the permissions of the running process."
}