CVE-2026-29518
Publication date 20 May 2026
Last updated 19 June 2026
Ubuntu priority
Description
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
Why is this CVE high priority?
rsync developers have rated this as being a high severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| rsync | 26.04 LTS resolute |
Fixed in 3.4.1+ds1-7ubuntu0.2
|
| 24.04 LTS noble |
Fixed in 3.2.7-1ubuntu1.4
|
|
| 22.04 LTS jammy |
Fixed in 3.2.7-0ubuntu0.22.04.6
|
|
| 20.04 LTS focal |
Fixed in 3.1.3-8ubuntu0.9+esm1
|
|
| 18.04 LTS bionic |
Fixed in 3.1.2-2.1ubuntu1.6+esm3
|
|
| 16.04 LTS xenial |
Fixed in 3.1.1-3ubuntu1.3+esm5
|
|
| 14.04 LTS trusty |
Fixed in 3.1.0-2ubuntu0.4+esm3
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version:
Base score
7.3 · High
Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base score
7.0 · High
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8283-1
- rsync vulnerabilities
- 20 May 2026
- USN-8349-1
- rsync vulnerabilities
- 1 June 2026