Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
rsync may let attackers replace files when chroot disabled
published 5 months ago
Summary
CentOS rsync can be tricked by a timing race when the chroot setting is turned off, allowing a malicious link to cause the daemon to work with the wrong files. This could let an attacker read, modify, or replace data on the server. Update rsync to the latest version that includes the fix to stop the issue.
What to do
- Update centos rsync to version 3.1.2-12.0.1.el7_9.tuxcare.els7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | rsync |
< 3.1.2-12.0.1.el7_9.tuxcare.els7 Fix: upgrade to 3.1.2-12.0.1.el7_9.tuxcare.els7
|
Original advisory text
rsync: Fix of CVE-2026-29518
- CVE-2026-29518: fix TOCTOU symlink race in daemon file handling
exposed when "use chroot = no"
exposed when "use chroot = no"
References
Timeline
Published26 May 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1779747925 · OSV
Track software like this
Free during beta