Description

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T15:19:51.553Z",
  "pubdate": "2026-08-13T15:19:51.553Z",
  "executiveSummary": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in rsync before 3.5.0 within the non-daemon receiver's destination directory handling mechanism.\nThe vulnerability allows an attacker capable of manipulating destination path parent components to redirect file writes to unintended filesystem locations.\nThe flaw affects rsync versions before 3.5.0, specifically impacting the non-daemon receiver mode during file synchronization operations.\nRisk implications include unauthorized file writes, potential data corruption, and unauthorized file overwrite outside the intended destination tree.\nAttacker capabilities require the ability to manipulate destination path parent components and execute a race condition timing attack.\nExploitation requirements depend on successfully winning the race condition between path resolution and the execution of the chdir() call.",
  "technicalDetails": "The root cause of the vulnerability is a time-of-check to time-of-use (TOCTOU) race condition residing in the non-daemon receiver's destination directory handling logic.\nThe vulnerable component is the destination path resolution and working directory establishment routine utilizing the chdir() call.\nAffected versions include all rsync deployments prior to version 3.5.0.\nExploitation occurs when an attacker substitutes a symbolic link for a component of the destination path during the window between path resolution (the check) and the actual chdir() call (the use).\nThe attack flow proceeds as follows: First, the rsync receiver resolves the intended destination path. Second, before the receiver executes the chdir() call to establish its working directory, the attacker replaces a parent component of the destination path with a symlink pointing to an arbitrary filesystem location.\nThird, the receiver executes the chdir() call, inadvertently establishing its working directory outside the intended destination tree due to the substituted symlink.\nFinally, subsequent relative-path file writes performed by the rsync receiver land in unintended filesystem locations determined by the attacker-controlled symlink.\nAuthentication requirements, privilege requirements, and network exposure depend entirely on the local or remote execution context of the non-daemon receiver invocation.\nPost-exploitation impact involves unauthorized file creation, modification, or overwriting of system files depending on the execution privileges of the rsync receiver process."
}