CVE-2026-43619

A flaw was found in rsync. A local attacker with filesystem access on the daemon host can exploit a symlink race vulnerability (CWE-367 Time-of-check to time-of-use) in rsync daemons configured with 'use chroot = no'. This allows the attacker to redirect path-based system calls, such as chmod, lchown, or unlink, outside the intended module. This could lead to unauthorized file operations or other security bypasses.

Moderate: A symlink race vulnerability affects rsync daemons when configured with use chroot = no, allowing a local attacker with filesystem access to perform unauthorized file operations outside the intended module. This risk is present only when the non-default use chroot = no setting is active.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the rsync daemon is configured with use chroot = yes. This can be achieved by editing the rsyncd.conf file, typically located at /etc/rsyncd.conf, and setting use chroot = yes within the relevant module configuration. After modifying the configuration, the rsync service must be restarted for the changes to take effect. This may temporarily interrupt active rsync operations.