Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-13T15:19:51.750Z",
  "pubdate": "2026-08-13T15:19:51.750Z",
  "executiveSummary": "A symlink race condition vulnerability exists in rsync before version 3.5.0 within the sender's source tree traversal mechanism. This flaw enables an attacker capable of manipulating a parent directory of the source tree to redirect file read operations to arbitrary, unintended file system paths outside the intended transfer root.\nThe primary impact of this vulnerability is unauthorized information disclosure, allowing attackers to read sensitive file contents that reside outside the defined source root. The affected product is rsync in versions prior to 3.5.0.\nExploitation of this security issue requires the attacker to possess the capability to manipulate a parent directory component of the source tree. The attack relies on a Time-of-Check to Time-of-Use (TOCTOU) race condition between the path resolution phase and the subsequent file open operation performed by the sender.\nRisk implications include potential data breaches and unauthorized exposure of confidential system files if an attacker successfully exploits the race condition during rsync synchronization operations.",
  "technicalDetails": "The root cause of the vulnerability lies in a Time-of-Check to Time-of-Use (TOCTOU) symlink race condition during the sender's source tree traversal in rsync before version 3.5.0. When traversing the source directory hierarchy, rsync performs path resolution prior to executing file open operations.\nThe vulnerable component is the sender's source tree traversal and file access logic. Affected versions include all rsync deployments prior to version 3.5.0.\nThe attack flow proceeds as follows: First, the rsync sender initiates a traversal of the source tree, resolving paths to prepare for file reading and transfer. Second, an attacker with manipulation privileges over a parent directory component of the source tree identifies the operational window between path resolution and the file open system call. Third, the attacker atomically replaces the parent directory component with a symbolic link pointing to an arbitrary path outside the designated source root. Finally, when rsync executes the file open operation, the kernel follows the newly substituted symbolic link, causing rsync to read and transmit data from the unintended external path rather than the legitimate source tree.\nPrivilege and authentication requirements depend on the attacker's ability to manipulate the parent directory components within the local or accessible file system path of the source tree. Network exposure is dependent on how rsync is invoked and exposed, but the vulnerability fundamentally stems from local file system interactions during source traversal. The resulting payload behavior manifests as unauthorized file content disclosure to the requesting client or process."
}