PT-2026-42053 · Rsync+2 · Rsync+2

Andrew Tridgell · Published 2026-05-20 · Updated 2026-06-01 · CVE-2026-43619

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3

Description A symlink race condition exists in path-based system calls, including chmod(), lchown(), utimes(), rename(), unlink(), mkdir(), symlink(), mknod(), link(), rmdir(), and lstat(). Local attackers with filesystem access can exploit the timing window between path resolution and system call execution by swapping symlinks. This allows the redirection of operations to files outside the exported rsync module, enabling the application of sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files. This issue affects rsync daemons configured with use chroot = no.

Recommendations Update to version 3.4.3 or later. Configure rsync daemons to use use chroot = yes to prevent access outside the module boundary.

Fix

Time Of Check To Time Of Use

Link Following

Weakness Enumeration

CWE-367

CWE-59

Related Identifiers

CVE-2026-43619

ECHO-2DE0-1B04-BAD9

OPENSUSE-SU-2026:10857-1

USN-8283-1

USN-8349-1

Affected Products

Linuxmint

Ubuntu

Rsync

References · 33

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10857-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41035 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45232 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8283-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8349-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8349-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29518 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43619 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-43619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43619 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8283-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-10158 · Vendor Advisory