---
id: CVE-2026-29518
title: >-
  Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU)
  race condition in daemon file handling that allows attackers to redirect file
  writes outside intended directories by replacing parent directory components
  with s…
summary: >-
  Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU)
  race condition in daemon file handling that allows attackers to redirect file
  writes outside intended directories by replacing parent directory components
  with s…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-367
  - CWE-367
vendor: samba
product: rsync
affected:
  - rsync < 3.4.3
patched:
  - rsync 3.4.3
published: '2026-05-20'
updated: '2026-08-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-29518'
references:
  - url: >-
      https://github.com/RsyncProject/rsync/pull/895/changes/8471fdd1561049ef5f58df44a1811a50bd9a531d
    label: disclosure@vulncheck.com
  - url: 'https://github.com/RsyncProject/rsync/releases/tag/v3.4.3'
    label: disclosure@vulncheck.com
  - url: >-
      https://michael.stapelberg.ch/posts/2026-05-24-minimal-memory-safe-go-rsync-vulns/
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rsync-toctou-race-condition-allows-symlink-based-arbitrary-file-write
    label: disclosure@vulncheck.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:26332'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26408'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26410'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:29197'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:54769'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-29518'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2469055'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29518.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.0014
epssPercentile: 0.02742
ingestedAt: '2026-08-19T12:38:47.151Z'
---

## Overview

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

## Affected

- `rsync < 3.4.3`

## Remediation

Upgrade past the affected range:

- `rsync 3.4.3`