Description

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-13T15:19:52.623Z",
  "pubdate": "2026-08-13T15:19:52.623Z",
  "executiveSummary": "A symlink race condition vulnerability exists in rsync before version 3.5.0 within the sender's directory scanning logic.\nThe vulnerability allows malicious actors to cause the sender to enumerate and transfer files located outside of the intended module root subtree.\nThis flaw impacts both daemon-mode and non-daemon sender-side scanning operations, presenting significant risk to data confidentiality and integrity by exposing unauthorized filesystem areas.\nTo successfully exploit this condition, an attacker requires the capability to create or manipulate symbolic links within a path component of the actively scanned directory tree.\nExploitation involves timing-dependent file system manipulation to bypass structural containment boundaries enforced by the application configuration.",
  "technicalDetails": "The root cause of the vulnerability lies in a Time-of-Check to Time-of-Use (TOCTOU) race condition during the directory scanning and traversal phase within the sender's logic.\nSpecifically, the vulnerability manifests in the interval between the execution of the lstat() system call and the subsequent opendir() system call performed on path components within the scanned tree.\nAn attacker who possesses the ability to create or manipulate symbolic links in a path component of the scanned tree can intercept this temporal window.\nStep-by-step attack flow: First, the rsync sender initiates a scan of the target directory structure, evaluating path components using lstat() to verify file types and properties against expected configurations. Second, during the precise window between the completion of the lstat() check and the invocation of opendir() on the target path, the attacker replaces a legitimate symbolic link with a crafted directory entry pointing to a location entirely outside the intended module root.\nThird, when the application proceeds with the opendir() call, it follows the newly substituted entry, causing the sender to traverse, enumerate, and ultimately transfer files residing beyond the secure module boundary.\nAffected versions include all rsync releases prior to 3.5.0.\nThe vulnerable component is the sender-side directory scanning and traversal logic.\nThis vulnerability is applicable to both daemon-mode deployments and non-daemon sender-side operations.\nAttacker capabilities require local or remote write access sufficient to create or modify symbolic links within the targeted source directory path components prior to or during the synchronization operation."
}