Description

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T15:19:52.130Z",
  "pubdate": "2026-08-13T15:19:52.130Z",
  "executiveSummary": "A symlink race condition vulnerability exists in rsync before version 3.5.0, enabling local attackers to manipulate Access Control Lists (ACLs) and extended attributes (xattrs) on unintended files. The vulnerability stems from a time-of-check to time-of-use (TOCTOU) race condition during the file write and metadata application phases.\nSuccessful exploitation allows a local attacker with specific capabilities to redirect arbitrary ACLs or extended attributes through crafted symbolic links pointing outside the intended destination tree. This manipulation can grant elevated permissions, bypass intended access controls, and potentially facilitate local privilege escalation.\nThe affected product is rsync prior to version 3.5.0. The vulnerability requires local access to the system, the ability to predict or manipulate destination paths, and precise timing capabilities to intercept the execution window between file write operations and the subsequent metadata assignment functions.\nThe risk implication is significant for multi-user or shared environments where untrusted local users can interact with synchronization targets. Mitigation relies on updating rsync to version 3.5.0 or later once patches are available.",
  "technicalDetails": "The vulnerability is rooted in a race condition occurring within the file synchronization and metadata application logic of rsync before version 3.5.0. Specifically, the flaw involves the asynchronous execution window situated between the initial file write operation and the subsequent invocation of metadata assignment system calls, namely acl_set_file() and lsetxattr().\nThe vulnerable component handles the application of security descriptors, such as Access Control Lists and extended attributes, to synchronized files. During normal operations, rsync writes data to a destination path and subsequently applies the associated metadata to secure the file according to the source parameters.\nExploitation requires local access and low-privileged capabilities. An attacker must monitor the synchronization process to identify predictable destination paths. The attack flow proceeds step-by-step as follows: first, the attacker anticipates or observes the initiation of a file write operation by rsync to a target destination. Second, during the critical timing window after the file write completes but before the metadata function is called, the attacker rapidly replaces the legitimate destination file or an intermediate directory component with a crafted symbolic link.\nWhen rsync executes the subsequent acl_set_file() or lsetxattr() system call, the operation follows the attacker-controlled symlink rather than evaluating the intended target. Because the system calls may follow symlinks depending on resolution context or implementation specifics, the ACLs or extended attributes are applied to the target of the symlink instead of the intended file.\nThis behavior allows the attacker to redirect arbitrary security descriptors to sensitive system files located outside the intended destination tree. Post-exploitation impact includes granting elevated permissions to unauthorized users, modifying security contexts, and achieving local privilege escalation by compromising files that govern system access."
}