Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-13T15:19:52.300Z",
  "pubdate": "2026-08-13T15:19:52.300Z",
  "executiveSummary": "A symlink race condition vulnerability exists within the --remove-source-files feature of rsync before version 3.5.0.\nThis vulnerability allows an attacker with symlink creation access to orchestrate arbitrary file deletion on the host system.\nThe core impact is the unauthorized destruction of critical system files or data targeted by malicious symbolic links.\nAffected systems include any deployments running rsync prior to version 3.5.0 utilizing source file removal flags.\nThe risk implication is severe, potentially leading to denial of service or data loss if high-privilege rsync processes process untrusted directories.\nAttacker capabilities require local or remote access allowing the creation of symbolic links within the transferred file paths.\nExploitation requires precise timing to win a race condition between the completion of a file transfer and the execution of the unlink() system call.",
  "technicalDetails": "The root cause of the vulnerability lies in a Time-of-Check to Time-of-Use (TOCTOU) race condition during the execution of the --remove-source-files feature in rsync before version 3.5.0.\nThe vulnerable component is the file cleanup routine responsible for invoking the unlink() function on source files after a successful network or local transfer.\nAffected versions explicitly encompass all rsync releases preceding version 3.5.0.\nPrivilege requirements depend on the execution context of the rsync daemon or client, but successful exploitation generally requires the ability to manipulate filesystem structures or create symlinks in the source directory path.\nNetwork exposure is dictated by how rsync is exposed, whether via local execution, SSH, or the native rsync daemon protocol, though the vector fundamentally relies on filesystem interactions.\nThe attack flow proceeds as follows: First, rsync initiates the transfer of a legitimate source file, reading its contents and writing them to the destination. Second, upon completion of the data transfer, a temporal gap exists before rsync calls unlink() on the original source file. Third, during this exact window, a malicious actor atomically replaces the original source file with a symbolic link pointing to a critical system file or arbitrary target of their choice. Fourth, rsync executes the pending unlink() system call against the path, resolving the newly substituted symbolic link. Consequently, the operating system deletes the symlink target rather than the intended source file, resulting in arbitrary file deletion."
}