CVE-2026-44509

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3

Description rsync is a file-copying tool utilizing a delta-transfer algorithm to synchronize files. A symlink race condition exists in path-based system calls such as chmod() and chown(), as previous fixes for open() calls did not cover these functions. For rsync daemons configured with use chroot = no, a local attacker can exploit this to modify permissions, ownership, or timestamps of files located outside the exported module.

Recommendations Update to version 3.4.3.