CVE-2026-29518 is a TOCTOU race condition vulnerability in RsyncProject's rsync daemon file handling prior to version 3.4.3. The flaw arises when the chroot setting is false, enabling an attacker who has write access to a module path to replace directory components with symbolic links during the race window. This manipulation allows redirection of file writes outside the intended directory tree, permitting creation or overwriting of arbitrary files. If the rsync daemon runs with elevated privileges, this can lead to privilege escalation. The vulnerability has a CVSS 4.0 score of 7.3, indicating high severity. No official patch or remediation level has been confirmed yet.

Successful exploitation permits attackers with write access to a module path to create or overwrite arbitrary files outside the intended directory, including sensitive system files. This can lead to privilege escalation if the rsync daemon is running with elevated privileges. The vulnerability requires the daemon's chroot setting to be disabled and does not involve user interaction. The attack complexity is high, and privileges required are low, reflecting the need for some access but no user involvement.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the rsync daemon with the chroot setting disabled. Restrict write access to module paths to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.