https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:19 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-53796 <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-53796 https://cve.radiocsirt.org/vuln/euvd-2026-352617 EUVD-2026-352617 https://cve.radiocsirt.org/vuln/euvd-2026-352617 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53796 <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver&#39;s destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver&#39;s working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver&#39;s destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver&#39;s working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53796 https://cve.radiocsirt.org/vuln/msrc_cve-2026-53796 msrc_CVE-2026-53796 https://cve.radiocsirt.org/vuln/msrc_cve-2026-53796 https://cve.radiocsirt.org/vuln/oesa-2026-3949 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: rsync</p> <p>Rsync is an open source utility that provides fast incremental file transfer. It uses the &amp;amp;quot;rsync algorithm&amp;amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):</p> <p>Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with &amp;apos;use chroot = no&amp;apos;.(CVE-2026-43619)</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: rsync</p> <p>Rsync is an open source utility that provides fast incremental file transfer. It uses the &amp;amp;quot;rsync algorithm&amp;amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):</p> <p>Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with &amp;apos;use chroot = no&amp;apos;.(CVE-2026-43619)</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3949 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 <p>rsync-3.5.1-1.1 on GA media</p> <p>rsync-3.5.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 <p>Security update for rsync</p> <p>Security update for rsync</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-53796 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver&#39;s destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver&#39;s working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync</p> <p>rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver&#39;s destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver&#39;s working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-53796 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817 <p>Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817